Buffer overflow in Qpopper (popper) 4.0.4 and earlier allows local users to cause a denial of service and possibly execute arbitrary code via a long bulldir argument in the user's .qpopper-options configuration file.

In version 4, a buffer overflow was introduced into the qpopper source tree. This buffer overflow is related to the handling of the client-supplied username and is present when a POP3 session is being initiated. It is believed that the overflow occurs before authentication, so it may not be required that users have valid POP accounts. This vulnerability can lead to a compromise of root privileges to remote attackers.

There are buffer overflow vulnerabilities present in 3.x versions of the Qualcomm popper daemon. These vulnerabilities are remotely executable and since the daemons run as root, the host running qpopper can be completely compromised anonymously.

The remote qpopper service may be vulnerable to a denial of service (DoS) attack. If a string of longer than approximately 2048 characters is sent to the qpopper process, a denial of service condition will occur.

Delegate is reportedly vulnerable to a stack-based buffer overflow that may allow for the execution of arbitrary code. The condition exists if the argument to the 'USER' command is of excessive length. 

The ZetaMail server will crash if a username/password pair longer than 3500 characters is supplied by the client.

ID	Name	Product	Family	Severity
1794	Qualcomm Qpopper Username Remote Overflow	Nessus Network Monitor	POP Server	critical
1793	Qualcomm Qpopper Remote Overflows	Nessus Network Monitor	POP Server	critical
1792	Qualcomm Qpopper Remote Overflow DoS	Nessus Network Monitor	POP Server	critical
1791	Delegate Multiple Function Remote Overflows	Nessus Network Monitor	POP Server	critical
1790	ZetaMail Remote DoS	Nessus Network Monitor	POP Server	critical

Detections

Analytics

CVE-2002-0889

high

Tenable Plugins

critical

critical

critical

critical

critical