PT-2004-3567 · Qwikmail · Qwikmail Smtp

Publicado 2004-12-31 · Atualizado 2018-10-19 · CVE-2004-2677

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QwikMail SMTP (qwik-smtpd) versions 0.3 and earlier

Description The issue allows remote attackers to execute arbitrary code via format specifiers in the clientRcptTo array, and the Received and messageID variables, possibly involving HELO and hostname arguments.

Recommendations For QwikMail SMTP (qwik-smtpd) versions 0.3 and earlier, consider restricting access to the clientRcptTo array, Received, and messageID variables to minimize the risk of exploitation. Avoid using format specifiers in these variables until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2004-2677

Produtos afetados

Qwikmail Smtp

Referências · 10

• 🔥 http://securityfocus.com/bid/11572 · Exploit
• 🔥 https://exploit-db.com/exploits/620 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17917 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2677 · Nota de Segurança
• http://qwikmail.sourceforge.net/smtpd/qwik-smtpd-0.3.patch · Correção
• http://unl0ck.info/advisories/qwik-smtpd.txt · Nota
• http://vupen.com/english/advisories/2007/0687 · Nota
• http://securityfocus.com/archive/1/460600/100/0/threaded · Nota
• http://secunia.com/advisories/13037 · Aviso do Fabricante
• http://securitytracker.com/id?1012016 · Aviso do Fabricante