PT-2001-2222 · Extremail · Extremail

Published 2001-06-21 · Updated 2017-12-19 · CVE-2001-1078

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions eXtremail versions 1.1.9 and earlier

Description The issue allows remote attackers to gain root privileges by exploiting a format string vulnerability in the flog function. This can be achieved through format specifiers in various commands, including SMTP commands such as HELO, EHLO, MAIL FROM, and RCPT TO, as well as POP3 commands like USER and other commands executable after POP3 authentication.

Recommendations For eXtremail versions 1.1.9 and earlier, consider disabling the flog function as a temporary workaround until a patch is available. Restrict access to the SMTP and POP3 commands to minimize the risk of exploitation. Avoid using format specifiers in these commands until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2001-1078

Affected Products

Extremail

References · 10

• 🔥 http://securityfocus.com/bid/2908 · Exploit
• 🔥 https://exploit-db.com/exploits/20952 · Exploit
• 🔥 https://exploit-db.com/exploits/49 · Exploit
• 🔥 https://exploit-db.com/exploits/20954 · Exploit
• 🔥 https://exploit-db.com/exploits/20953 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-1078 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2001-06/0291.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6733 · Note
• http://extremail.com/history.htm · Note
• http://extremail.com/news.htm · Note