CVE-1999-1224: Low severity university of washington imapd vulnerability
IMAP 4.1 BETA, and possibly other versions, does not properly handle the SIGABRT (abort) signal, which allows local users to crash the server (imapd) via certain sequences of commands, which causes a core dump that may contain sensitive password information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable generation of core dumps for the imapd process to prevent sensitive information from being written to core files (for example, set ulimit -c 0 for the imapd user or configure the init/systemd service to prevent core dumps).
Operating system / imapd process core dump settings core dumps (core file generation) = disabled - Compensating control
Restrict local access to hosts running the University of Washington IMAP server: limit which accounts may log in locally, tighten sudo/shell permissions, and enforce least-privilege so untrusted local users cannot execute sequences of commands that could crash imapd.
- Operational
If an imapd crash or core dump has occurred, assume password exposure: securely delete any core files, and rotate passwords/credentials for affected user and service accounts.
- Operational
Monitor University of Washington IMAP advisories for a vendor-supplied fix addressing the SIGABRT handling issue and apply the vendor patch as soon as it becomes available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1224?
CVE-1999-1224 is considered a local denial of service vulnerability.
How do I fix CVE-1999-1224?
To fix CVE-1999-1224, it is recommended to update to a version of the IMAP server that addresses this vulnerability.
Which software is affected by CVE-1999-1224?
CVE-1999-1224 affects University of Washington IMAP versions 4.1 and potentially earlier versions.
Can CVE-1999-1224 lead to information disclosure?
Yes, CVE-1999-1224 can potentially lead to information disclosure through core dumps that may contain sensitive password information.
Is CVE-1999-1224 exploitable remotely?
No, CVE-1999-1224 is a local vulnerability that requires access to the server to exploit.