CVE-2004-1013: Critical severity Carnegie Mellon University Cyrus Imap Server vulnerability
The argument parser of the FETCH command in Cyrus IMAP Server 2.2.x through 2.2.8 allows remote authenticated users to execute arbitrary code via certain commands such as (1) "body[p", (2) "binary[p", or (3) "binary[p") that cause an index increment error that leads to an out-of-bounds memory corruption.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2004-1013?
CVE-2004-1013 is classified as a high severity vulnerability which allows remote authenticated users to execute arbitrary code.
How do I fix CVE-2004-1013?
To fix CVE-2004-1013, update your Cyrus IMAP Server to version 2.2.9 or later, which addresses this vulnerability.
Which versions of Cyrus IMAP Server are affected by CVE-2004-1013?
CVE-2004-1013 affects Cyrus IMAP Server versions 2.2.0 through 2.2.8 and several earlier versions.
Can CVE-2004-1013 be exploited without authentication?
No, CVE-2004-1013 requires remote authentication for exploitation, meaning an attacker must have valid user credentials.
What types of commands trigger the CVE-2004-1013 vulnerability?
Certain FETCH command arguments such as "body[p" and "binary[p" can trigger the vulnerability in CVE-2004-1013.