Detections
Analytics

IMAP pop-2d POP Daemon FOLD Command Remote Overflow

critical Nessus Plugin ID 10130

Synopsis

The remote IMAP server is affected by a buffer overflow vulnerability.

Description

There is a buffer overflow in the imap suite provided with Debian GNU/Linux 2.1, which has a vulnerability in its POP-2 daemon, found in the ipopd package. This vulnerability allows an attacker to gain a shell as user 'nobody', but requires the attacker to have a valid pop2 account.

Solution

Upgrade to imap-4.5 or later as this reportedly fixes the issue.

See Also

https://marc.info/?l=bugtraq&m=92774876916776&w=2

Plugin Details

Severity: Critical

ID: 10130

File Name: ipop2d.nasl

Version: 1.34

Type: remote

Published: 6/22/1999

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

Required KB Items: pop2/password

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 5/26/1999

Reference Information

CVE: CVE-1999-0920

BID: 283