Description
Stack-based buffer overflow in Cyrus IMAP Server 2.2.4 through 2.2.8, with the imapmagicplus option enabled, allows remote attackers to execute arbitrary code via a long (1) PROXY or (2) LOGIN command, a different vulnerability than CVE-2004-1015.
References
- http://security.e-matters.de/advisories/152004.html
- cyrus-imap-username-bo(18198) vdb-entry
- http://asg.web.cmu.edu/cyrus/download/imapd/changes.html
- MDKSA-2004:139 vendor-advisory
- 20041122 Advisory 15/2004: Cyrus IMAP Server multiple remote vulnerabilities mailing-list
- [cyrus-announce] 20041122 Cyrus IMAPd 2.2.9 Released mailing-list
- 13274 third-party-advisory
- GLSA-200411-34 vendor-advisory