BID:11123

gnubiff Multiple Remote POP3 Protocol Vulnerabilities

Info

gnubiff Multiple Remote POP3 Protocol Vulnerabilities

Bugtraq ID:	11123
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 07 2004 12:00AM
Updated:	Sep 07 2004 12:00AM
Credit:	The individual responsible for the discovery of this issue is currently unknown; the vendor disclosed this issue.
Vulnerable:	GNU gnubiff 1.4 GNU gnubiff 1.2 GNU gnubiff 1.0.10 GNU gnubiff 1.0.9 GNU gnubiff 1.0.8 GNU gnubiff 1.0.7 GNU gnubiff 1.0.6 GNU gnubiff 1.0.5 GNU gnubiff 1.0.4 GNU gnubiff 1.0.3 GNU gnubiff 1.0.2 GNU gnubiff 1.0.1

Not Vulnerable:	GNU gnubiff 2.0.1 GNU gnubiff 2.0

Discussion

gnubiff Multiple Remote POP3 Protocol Vulnerabilities

Reportedly gnubiff is affected by multiple pop3 protocol vulnerabilities. The first issue is due to a design error in the pop3 protocol implementation that causes the application the crash. The second issue is a buffer overflow in the pop3 implementation.

An attacker might leverage these issues to cause the affected application to crash and to manipulate process memory ultimately facilitating arbitrary code execution.

Exploit / POC

gnubiff Multiple Remote POP3 Protocol Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.