Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002…
Priority MEDIUM 52CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.
Summary
Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and '+' character followed by a long string, processed by the tmail or possibly dmail program.
Why it matters now
EPSS 0.06355 93rd percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:university_of_washington:alpine:0.80:*:*:*:*:*:*:* | 0.80 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:alpine:0.81:*:*:*:*:*:*:* | 0.81 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:alpine:0.82:*:*:*:*:*:*:* | 0.82 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:alpine:0.83:*:*:*:*:*:*:* | 0.83 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:alpine:0.98:*:*:*:*:*:*:* | 0.98 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:alpine:0.99:*:*:*:*:*:*:* | 0.99 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:alpine:0.999:*:*:*:*:*:*:* | 0.999 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:alpine:0.9999:*:*:*:*:*:*:* | 0.9999 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:alpine:0.99999:*:*:*:*:*:*:* | 0.99999 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:alpine:0.999999:*:*:*:*:*:*:* | 0.999999 | Vulnerable | University Of Washington |
- cpe:2.3:a:university_of_washington:alpine:0.80:*:*:*:*:*:*:* Versions 0.80 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:alpine:0.81:*:*:*:*:*:*:* Versions 0.81 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:alpine:0.82:*:*:*:*:*:*:* Versions 0.82 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:alpine:0.83:*:*:*:*:*:*:* Versions 0.83 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:alpine:0.98:*:*:*:*:*:*:* Versions 0.98 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:alpine:0.99:*:*:*:*:*:*:* Versions 0.99 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:alpine:0.999:*:*:*:*:*:*:* Versions 0.999 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:alpine:0.9999:*:*:*:*:*:*:* Versions 0.9999 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:alpine:0.99999:*:*:*:*:*:*:* Versions 0.99999 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:alpine:0.999999:*:*:*:*:*:*:* Versions 0.999999 Vulnerable ·University Of Washington
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:university_of_washington:alpine:1.00:*:*:*:*:*:*:* | 1.00 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:alpine:1.10:*:*:*:*:*:*:* | 1.10 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:alpine:2.00:*:*:*:*:*:*:* | 2.00 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:imap_toolkit:2002:*:*:*:*:*:*:* | 2002 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:imap_toolkit:2003:*:*:*:*:*:*:* | 2003 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:imap_toolkit:2004:*:*:*:*:*:*:* | 2004 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:imap_toolkit:2005:*:*:*:*:*:*:* | 2005 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:imap_toolkit:2006:*:*:*:*:*:*:* | 2006 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:imap_toolkit:2007:*:*:*:*:*:*:* | 2007 | Vulnerable | University Of Washington |
| cpe:2.3:a:university_of_washington:imap_toolkit:2007c:*:*:*:*:*:*:* | 2007c | Vulnerable | University Of Washington |
- cpe:2.3:a:university_of_washington:alpine:1.00:*:*:*:*:*:*:* Versions 1.00 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:alpine:1.10:*:*:*:*:*:*:* Versions 1.10 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:alpine:2.00:*:*:*:*:*:*:* Versions 2.00 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:imap_toolkit:2002:*:*:*:*:*:*:* Versions 2002 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:imap_toolkit:2003:*:*:*:*:*:*:* Versions 2003 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:imap_toolkit:2004:*:*:*:*:*:*:* Versions 2004 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:imap_toolkit:2005:*:*:*:*:*:*:* Versions 2005 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:imap_toolkit:2006:*:*:*:*:*:*:* Versions 2006 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:imap_toolkit:2007:*:*:*:*:*:*:* Versions 2007 Vulnerable ·University Of Washington
- cpe:2.3:a:university_of_washington:imap_toolkit:2007c:*:*:*:*:*:*:* Versions 2007c Vulnerable ·University Of Washington
Remediation
Red Hat 1 advisory
- RHSA-2009:0275 Released 2009-02-19 · Red Hat rating Moderateimap security update
- Red Hat Desktop version 3 imap-1:2002d-15, imap-1:2002d-15.i386, imap-devel-1:2002d-15 +3
- Red Hat Enterprise Linux AS version 3 imap-1:2002d-15, imap-1:2002d-15.i386, imap-1:2002d-15.ia64 +9
- Red Hat Enterprise Linux ES version 3 imap-1:2002d-15, imap-1:2002d-15.i386, imap-1:2002d-15.ia64 +6
- Red Hat Enterprise Linux WS version 3 imap-1:2002d-15, imap-1:2002d-15.i386, imap-1:2002d-15.ia64 +6
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Desktop version 3 | Fixed | RHSA-2009:0275 |
| Red Hat Enterprise Linux AS version 3 | Fixed | RHSA-2009:0275 |
| Red Hat Enterprise Linux ES version 3 | Fixed | RHSA-2009:0275 |
| Red Hat Enterprise Linux WS version 3 | Fixed | RHSA-2009:0275 |
Timeline
- 2026-10-02 Threatist record created from CVE-2008-5005
- 2026-10-03 Alias added: GHSA-9hgh-p6fq-92mm
References
Patch 2
Other 12
- oval:org.mitre.oval:def:10485
- http://panda.com/imap/
- [oss-security] 20081103 CVE request - uw-imap
- http://www.bitsec.com/en/rad/bsa-081103.txt
- http://www.bitsec.com/en/rad/bsa-081103.c
- http://support.avaya.com/elmodocs2/security/ASA-2009-065.htm
- [oss-security] 20081103 Re: CVE request - uw-imap
- http://www.washington.edu/alpine/tmailbug.html
- [imap-uw] 20081031 Security bug in tmail and dmail
- 20081103 Bitsec Security Advisory: UW/Panda IMAP [dt]mail buffer overflow
- [oss-security] 20081103 Re: CVE request - uw-imap
- ADV-2008-3042
Sources
- CVE-2008-5005 · CVE Program
- CVE-2008-5005 · NVD
- FIRST EPSS
- GHSA-9hgh-p6fq-92mm · GitHub Advisory Database · CC BY 4.0
- CVE-2008-5005 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences