# CVE-1999-1224: University of Washington IMAP 4.1 BETA Information Disclosure via Core Dump

Source: https://junglewise.ai/threats/cve-1999-1224-university-of-washington-imap-4-1-beta-information-disclosure-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1997-10-08. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1224 · Severity: low · CVSS 3.6 · Published 1997-10-08

The University of Washington IMAP server, used for managing email on a server, contains a flaw in how it handles internal errors. An attacker with a valid user account can send specific commands that cause the server to crash and generate a diagnostic 'core dump' file in the user's directory. This file may contain highly sensitive information, including the system's password and shadow files, potentially allowing the attacker to gain full administrative control of the server.

Vendors: [University Of Washington](https://junglewise.ai/threats/vendors/university-of-washington).

## Quick answers

**Is CVE-1999-1224 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1224 being exploited in the wild.

**How severe is CVE-1999-1224?** Low severity, with a CVSS score of 3.6, published 8 October 1997.

**Which products and versions are affected?** University Of Washington IMAP Toolkit 4.1 BETA.

**Is there a fix for CVE-1999-1224?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1224 attacked?** It is attacked over the network or with local access, in a hosted service.

**Am I affected by CVE-1999-1224?** Check whether you run University Of Washington IMAP Toolkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The imapd server in the University of Washington IMAP 4.1 toolkit fails to catch or ignore the SIGABRT signal when the fatal() function is called. Because IMAP allows users to maintain folders in writable directories on the server, the resulting abort() call generates a core dump file in a location accessible to the user. This core dump often contains the contents of /etc/passwd and /etc/shadow that were resident in memory. An attacker with existing credentials can trigger this via specific command sequences (e.g., CREATE/SELECT/COPY operations) to extract system-wide credentials. A recommended mitigation is to disable core dumps for the service using 'ulimit -c 0'.

## Affected products

- University of Washington IMAP Toolkit 4.1 BETA

## Timeline

- 1997-10-08: disclosed: L0pht Security Advisory released by Mudge
- 1997-10-08: advisory: NVD published date

## References

- [http://marc.info/?l=bugtraq&m=87635124302928&w=2](http://marc.info/?l=bugtraq&m=87635124302928&w=2)
- [https://exchange.xforce.ibmcloud.com/vulnerabilities/349](https://exchange.xforce.ibmcloud.com/vulnerabilities/349)