PT-2000-1491 · Cmail · Cmail

Published 2000-06-05 · Updated 2017-10-10 · CVE-2000-0556

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Cmail version 2.4.7

Description A buffer overflow issue exists in the web interface, allowing remote attackers to cause a denial of service. This can be achieved by sending a large username to the user dialog running on port 8002, specifically the / API endpoint is not mentioned but the attack vector is related to the username variable.

Recommendations For Cmail version 2.4.7, consider restricting access to the web interface or limiting the size of the username variable to prevent exploitation until a fix is available.

Fix

Related Identifiers

CVE-2000-0556

Affected Products

Cmail

References · 5

• http://securityfocus.com/bid/1319 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2000-0556 · Security Note
• http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0248.html · Vendor Advisory
• http://computalynx.net/news/Jun2000/news0806200001.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/4625 · Note