CVE-2004-1558: YPOPs! POP3 USER and SMTP request stack buffer overflows

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote, unauthenticated buffer overflows with public exploit references and a very high EPSS score, though the product is old and no longer widely deployed.

What it is

YPOPs! (YahooPOPS) versions 0.4 through 0.6 contain multiple stack-based buffer overflows reachable through a long POP3 USER command or a long SMTP request. A remote, unauthenticated attacker can crash the service and possibly execute arbitrary code on the host running the affected software.

Impact

An attacker can cause a denial of service and potentially achieve arbitrary code execution in the context of the YPOPs! process. Successful code execution would give the attacker control over the mail-proxying host.

Attack surface

The flaw is reached over the network through the POP3 and SMTP interfaces that YPOPs! exposes; the CVSS vector AV:N/AC:L/Au:N indicates no authentication is required. No user interaction is described in the record.

Exploitation

The record is not listed in CISA KEV, but EPSS is high (0.71107, 99.375th percentile) and two references carry an Exploit tag, indicating public exploit material exists.

What to do

• Upgrade YPOPs! to a version later than 0.6, or remove the product if it is no longer maintained.
• Restrict network access to the POP3 and SMTP listener ports so only trusted hosts can connect.
• Run YPOPs! under a low-privilege account to limit the impact of any code execution.
• Monitor vendor and OSVDB references for a fixed release and apply it as soon as available.

Detection

• Inspect POP3 and SMTP logs for USER commands or request lines that are abnormally long or contain repeated byte patterns.
• Alert on YPOPs! process crashes or unexpected restarts, which may indicate a buffer overflow attempt.
• Use network IDS signatures for oversized POP3 USER and SMTP request payloads directed at YPOPs! ports.
• Monitor for unexpected child processes or outbound connections spawned by the YPOPs! process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.