PT-2004-3567 · Qwikmail · Qwikmail Smtp

Published 2004-12-31 · Updated 2018-10-19 · CVE-2004-2677

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QwikMail SMTP (qwik-smtpd) versions 0.3 and earlier

Description The issue allows remote attackers to execute arbitrary code via format specifiers in the clientRcptTo array, and the Received and messageID variables, possibly involving HELO and hostname arguments.

Recommendations For QwikMail SMTP (qwik-smtpd) versions 0.3 and earlier, consider restricting access to the clientRcptTo array, Received, and messageID variables to minimize the risk of exploitation. Avoid using format specifiers in these variables until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2004-2677

Affected Products

Qwikmail Smtp

References · 10

• 🔥 http://securityfocus.com/bid/11572 · Exploit
• 🔥 https://exploit-db.com/exploits/620 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2677 · Security Note
• http://qwikmail.sourceforge.net/smtpd/qwik-smtpd-0.3.patch · Patch
• http://secunia.com/advisories/13037 · Vendor Advisory
• http://securitytracker.com/id?1012016 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17917 · Note
• http://unl0ck.info/advisories/qwik-smtpd.txt · Note
• http://vupen.com/english/advisories/2007/0687 · Note
• http://securityfocus.com/archive/1/460600/100/0/threaded · Note