POP3 password overflow

CERT: CA-97.09.imap_pop  

 

CERT: CA-98.08.qpopper_vul  

 

advICE: Buffer overflows  

More about this general class of attacks, which is the root cause of many attacks on the Internet.  

eEye: Multiple Vulnerabilities in Mercur Mail Server  

 

BugtraqID: 791   Artisoft XtraMail Multiple DoS Vulnerabilities

Password of over 1500 characters overflows the buffer.  

BugtraqID: 755   aVirt Mail Server Buffer Overflow

Typical buffer overflow if more than 856 characters are sent.  

BugtraqID: 634   FuseWare FuseMail POP Mail Buffer Overflow Vulnerability

Overflow exists for both USER and PASS fields.  

BugtraqID: 133   Qualcomm POP Server Buffer Overflow Vulnerability

Any version prior to 2.5 is vulnerable to buffer overflows in USER and PASS commands, and any line longer than 1024.  

BugtraqID: 942  

 

CVE-1999-0759   Buffer overflow in FuseMAIL POP service via long USER and PASS commands.

 

CVE-2000-0091   vchkpw/vpopmail POP buffer overflow

 

CVE-1999-0042   UW's POP/IMAP

 

Other POP3 exploits