SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2004-1013

The argument parser of the FETCH command in Cyrus IMAP Server 2.2.x through 2.2.8 allows remote authenticated users to execute arbitrary code via certain commands such as (1) "body[p", (2) "binary[p", or (3) "binary[p") that cause an index increment…

HIGH 10.0EPSS 5.83%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (5.83%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The argument parser of the FETCH command in Cyrus IMAP Server 2.2.x through 2.2.8 allows remote authenticated users to execute arbitrary code via certain commands such as (1) "body[p", (2) "binary[p", or (3) "binary[p") that cause an index increment error that leads to an out-of-bounds memory corruption.

CVSS 2.0
10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS
5.83% probability · 93th percentile
CISA KEV
Not listed
Affected
carnegie mellon university/cyrus imap server · openpkg/openpkg · conectiva/linux · redhat/fedora core · trustix/secure linux · ubuntu/ubuntu linux
Source
cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.