PT-2008-2655 · Netwin · Netwin Surgemail+1

Luigi Auriemma · Publicado 2008-02-27 · Atualizado 2018-10-11 · CVE-2008-1055

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NetWin SurgeMail versions 38k4 and earlier NetWin SurgeMail beta 39a WebMail versions 3.1s and earlier

Description The issue allows remote attackers to cause a denial of service, potentially leading to daemon crash, and possibly execute arbitrary code. This is achieved through format string specifiers in the page parameter.

Recommendations For NetWin SurgeMail versions 38k4 and earlier, update to a version later than 38k4 to resolve the issue. For NetWin SurgeMail beta 39a, avoid using the beta version until a stable release is available that addresses the issue. For WebMail versions 3.1s and earlier, update to a version later than 3.1s to mitigate the risk. As a temporary workaround, consider restricting access to the page parameter in the affected API endpoint until a patch is available.

Exploit

Correção

DoS

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

CVE-2008-1055

Produtos afetados

Netwin Surgemail

Webmail

Referências · 12

• 🔥 https://exploit-db.com/exploits/31300 · Exploit
• 🔥 http://securityfocus.com/bid/27990 · Exploit
• http://vupen.com/english/advisories/2008/0678 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/40833 · Nota
• http://secunia.com/advisories/29105 · Aviso do Fabricante
• http://securitytracker.com/id?1019500 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1055 · Nota de Segurança
• http://secunia.com/advisories/29137 · Nota
• http://securityreason.com/securityalert/3705 · Nota
• http://securityfocus.com/archive/1/488741/100/0/threaded · Nota
• http://aluigi.altervista.org/adv/surgemailz-adv.txt · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1055 · Nota