CVE-2009-0671: University of Washington UW IMAP toolkit vulnerability
REJECT Format string vulnerability in the University of Washington (UW) c-client library, as used by the UW IMAP toolkit imap-2007d and other applications, allows remote attackers to execute arbitrary code via format string specifiers in the initial request to the IMAP port (143/tcp). NOTE: Red Hat has disputed the vulnerability, stating "The Red Hat Security Response Team have been unable to confirm the existence of this format string vulnerability in the toolkit, and the sample published exploit is not complete or functional." CVE agrees that the exploit contains syntax errors and uses Unix-only include files while invoking Windows functions.
Other sources
Rejected reason: Format string vulnerability in the University of Washington (UW) c-client library, as used by the UW IMAP toolkit imap-2007d and other applications, allows remote attackers to execute arbitrary code via format string specifiers in the initial request to the IMAP port (143/tcp). NOTE: Red Hat has disputed the vulnerability, stating "The Red Hat Security Response Team have been unable to confirm the existence of this format string vulnerability in the toolkit, and the sample published exploit is not complete or functional." CVE agrees that the exploit contains syntax errors and uses Unix-only include files while invoking Windows functions
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0671?
CVE-2009-0671 is classified as a critical vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2009-0671?
To fix CVE-2009-0671, update the University of Washington IMAP toolkit to a version that does not contain the vulnerability.
What kind of vulnerability is CVE-2009-0671?
CVE-2009-0671 is a format string vulnerability that can be exploited to execute arbitrary code.
Which software is affected by CVE-2009-0671?
CVE-2009-0671 affects the University of Washington IMAP toolkit and related applications utilizing the c-client library.
What is the attack vector for CVE-2009-0671?
The attack vector for CVE-2009-0671 involves sending specially crafted format string specifiers in the initial request to the IMAP port.