Quantum Secular Labs / Blog / Advisories

CVE-2008-5005: University Of Washington Alpine: Privilege escalation

CVE-2008-5005 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects University Of Washington Alpine. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and '+' character followed by a long string, processed by the tmail or possibly dmail program.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

Access vector: Network. Exploitable remotely over the network.
Access complexity: Low. No special conditions are required.
Authentication: None. No authentication is needed.
Confidentiality impact: Complete. Total information disclosure.
Integrity impact: Complete. Total loss of integrity.
Availability impact: Complete. Total shutdown of the component.

Underlying weakness

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected products

University Of Washington Alpine: 0.80; 0.81; 0.82; 0.83; 0.98; 0.99; 0.999; 0.9999; 0.99999; 0.999999; 1.00; 1.10
University Of Washington Imap Toolkit: 2002; 2003; 2004; 2005; 2006; 2007; 2007c