Format string vulnerability in search.c in the imap4d server in GNU Mailutils 0.6 allows remote authenticated users to execute arbitrary code via format string specifiers in the SEARCH command.

A format string vulnerability has been discovered in GNU mailutils which contains utilities for handling mail that allows a remote attacker to execute arbitrary code on the IMAP server.

The remote host is affected by the vulnerability described in GLSA-200509-10 (Mailutils: Format string vulnerability in imap4d)

    The imap4d server contains a format string bug in the handling of IMAP     SEARCH requests.
  Impact :

    An authenticated IMAP user could exploit the format string error in     imap4d to execute arbitrary code as the imap4d user, which is usually     root.
  Workaround :

    There are no known workarounds at this time.

GNU Mailutils is a collection of mail utilities, including an IMAP4 daemon, a POP3 daemon, and a very simple mail client. 

The remote host is running a version of GNU Mailutils containing a format string vulnerability in its IMAP4 daemon.  By exploiting these issues, a remote attacker may be able to execute code remotely in the context of the user executing the daemon process, typically root.

The remote host is running GNU Mailutils, an open source package that includes tools for running and managing a mail server.  This version of GNU Mailutils is vulnerable to several remote buffer overflows.  An attacker exploiting these flaws will be able to execute arbitrary code.

ID	Name	Product	Family	Severity
19845	Debian DSA-841-1 : mailutils - format string vulnerability	Nessus	Debian Local Security Checks	high
19742	GLSA-200509-10 : Mailutils: Format string vulnerability in imap4d	Nessus	Gentoo Local Security Checks	high
19605	GNU Mailutils imap4d Search Command Remote Format String	Nessus	Gain a shell remotely	medium
2938	GNU Mailutils Multiple IMAP Vulnerabilities	Nessus Network Monitor	POP Server	medium

Detections

Analytics

CVE-2005-2878

high

Tenable Plugins

high

high

medium

medium