CVE-2004-0777 Format string vulnerability in the auth_debug function in Courier-IMAP 1.6.0 through 2.2.1 and 3.x through 3.0.3, when login debugging (DEBUG_LOGIN) is enabled, allows remote attackers to execute arbi...
HighCVSS 7.5
EPSS 10.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Format string vulnerability in the auth_debug function in Courier-IMAP 1.6.0 through 2.2.1 and 3.x through 3.0.3, when login debugging (DEBUG_LOGIN) is enabled, allows remote attackers to execute arbitrary code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| inter7 courier-imap | = 1.6 | No fix listed |
| inter7 courier-imap | = 1.7 | No fix listed |
| inter7 courier-imap | = 2.0.0 | No fix listed |
| inter7 courier-imap | = 2.1 | No fix listed |
| inter7 courier-imap | = 2.1.1 | No fix listed |
| inter7 courier-imap | = 2.1.2 | No fix listed |
| inter7 courier-imap | = 2.2.0 | No fix listed |
| inter7 courier-imap | = 2.2.1 | No fix listed |
| debian/courier(Debian:12) | < 0.45.6-1 | 0.45.6-1 |
| debian/courier(Debian:13) | < 0.45.6-1 | 0.45.6-1 |
| debian/courier(Debian:14) | < 0.45.6-1 | 0.45.6-1 |
References
- Debian Security Tracker CVE-2004-0777 vendor-advisory
- bugs.debian.org issue-tracking
- GLSA-200408-19 vendor-advisory
- 10976 vdb-entry
- 2004-0043 vendor-advisory
- 20040818 Courier-IMAP Remote Format String Vulnerability third-party-advisory
- courierimap-authdebug-format-string(17034) vdb-entry