Description
Stack-based buffer overflow in Qualcomm WorldMail 3.0 allows remote attackers to execute arbitrary code via a long IMAP command that ends with a "}" character, as demonstrated using long (1) LIST, (2) LSUB, (3) SEARCH TEXT, (4) STATUS INBOX, (5) AUTHENTICATE, (6) FETCH, (7) SELECT, and (8) COPY commands.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Qualcomm WorldMail 3.0 IMAPD LIST Buffer Overflow
exploit/windows/imap/eudora_list
Exploit-DB 2
- Eudora Qualcomm WorldMail 3.0 - IMAPd 'LIST' Remote Buffer Overflow (Metasploit) EDB-16474 · remote · Jul 1, 2010 · verified
- Eudora Qualcomm WorldMail 3.0 - 'IMAPd' Remote Overflow EDB-1380 · remote · Dec 20, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 1015391 vdb-entry
- ADV-2005-3005 vdb-entry
- 20051220 [ACSSEC-2005-11-27-0x1] Eudora Qualcomm WorldMail 3.0 IMAP4 Servi ce 6.1.19.0 mailing-list
- 15980 vdb-entry
- 20051220 Qualcomm WorldMail IMAP Server String Literal Processing Overflow Vulnerability third-party-advisory
- 277 third-party-advisory
- 17640 third-party-advisory