IMAPrev1 v12.250 - Local BOF under Linux

[morpheusbd () GMX NET (Morpheus)]

Yesterday I've found something strange in the IMAP daemon.
I'm not sure if it is already a known bug but as far as I know this is new.
There is a buffer overflow in IMAPrev1 version 12.250.
I've exported the HOME-variable with about 1103 (arbitrary) chars.
(Your shell probably needs more characters.)
Something like this:

(on a NON-root shell)

$export HOME=`perl -e 'print "a" x 1110'`
$/usr/sbin/imapd

And it gave me "Speicherzugriffsfehler" (a Seg Fault).
I've tested it under SuSE 6.0/6.3 Linux distribution.
On my distribution the imap daemon is neither SUID root or
SGID root - but in my opinion a bug is a bug !
Afterwards I debugged it with gdb and it revealed that there has
to be a local buffer overflow regarding the HOME-variable (the EIP was
overwritten).
I'm currently trying to write an exploit-code for this.

regards,
Morpheus