Secunia

Two different vulnerabilities have been identified in multiple IMAP clients. On some systems it could be exploited to gain control of the client system.

The first problem is that some IMAP clients fail to handle huge literal sizes. This allows malicious servers to return a large value, which causes an integer overflow. This could in some cases be exploited to execute arbitrary code.

The following have all been reported to crash when attempting to exploit this:
c-client / UW-Imapd / imap-2002b
Pine 4.53
Sylpheed 0.8.11
Sylpheed-claws
Outlook Express 6

The following have all been reported to be vulnerable in a way that allows malicious servers to execute arbitrary code on the client system:
Evolution 1.2.4
Mozilla 1.3 and 1.4a
Eudora 5.2.1

The second problem is that some IMAP clients don't handle huge mailbox sizes correctly. This allows malicious IMAP servers to overflow the allocated space.

The following have all been reported to crash when attempting to exploit this:
mutt 1.4.1
Balsa 2.0.10

The following have all been reported to be vulnerable in a way that allows malicious servers to execute arbitrary code on the client system:
c-client / UW-imapd / imap-2002b
Pine 4.53

Solution
Do not connect to untrusted IMAP servers. If possible use SSL/TLS to connect to the server to defend against Man-in-the-Middle attacks.
Further details available in Customer Area

Provided and/or discovered by
Timo Sirainen

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area