PT-2007-6725 · Unknown+1 · Perdition Mail Retrieval Proxy+1

Publicado

2007-10-31

·

Atualizado

2018-10-15

·

CVE-2007-5740

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Perdition Mail Retrieval Proxy version 1.17 and earlier
Description The issue concerns the format string protection mechanism in IMAPD, which can be bypassed by remote attackers. This is achieved by using an IMAP tag that includes a null byte followed by a format string specifier. As a result, attackers can execute arbitrary code.
Recommendations For Perdition Mail Retrieval Proxy version 1.17 and earlier, consider disabling the IMAP functionality until a patch is available to prevent potential exploitation. Restrict access to the IMAPD service to minimize the risk of arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Use of Externally-Controlled Format String

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

CVE-2007-5740
DSA-1398-1
DTSA-84-1

Produtos afetados

Imapd
Perdition Mail Retrieval Proxy