CVE-2004-1012 - CVE House
Back to Database
Status published Critical CVE-2004-1012

The argument parser of the PARTIAL command in Cyrus IMAP...

Vulnerability Description

The argument parser of the PARTIAL command in Cyrus IMAP Server 2.2.6 and earlier allows remote authenticated users to execute arbitrary code via a certain command ("body[p") that is treated as a different command ("body.peek") and causes an index increment error that leads to an out-of-bounds memory corruption.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2004-1012

Credits & Attribution

No credits recorded in the NVD database.

References

More from carnegie mellon university

View All →
CVE-2009-0688
Multiple buffer overflows in the CMU Cyrus SASL library before...
High 7.5
CVE-2006-0250
Format string vulnerability in the snmp_input function in snmptrapd in...
Medium 6.4
CVE-2004-1067
Off-by-one error in the mysasl_canon_user function in Cyrus IMAP Server...
Critical 10
CVE-2004-1015
Buffer overflow in proxyd for Cyrus IMAP Server 2.2.9 and...
Critical 10
CVE-2004-1013
The argument parser of the FETCH command in Cyrus IMAP...
Critical 10

Affected Vendor

carnegie mellon university

View all reports →

Affected Software

cyrus imap server, openpkg, linux, fedora core, secure linux, ubuntu linux
Vulnerable Versions:
2.1.7, 2.1.9, 2.1.10, 2.1.16, 2.2.0_alpha, 2.2.1_beta, 2.2.2_beta, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, current, 9.0, 10.0, core_2.0, core_3.0, 2.0, 2.1, 2.2, 4.1

Timeline

Official Publish: December 1st, 2004
Last Modified: August 8th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.