PT-2008-2655 · Netwin · Netwin Surgemail+1

Luigi Auriemma · Published 2008-02-27 · Updated 2018-10-11 · CVE-2008-1055

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NetWin SurgeMail versions 38k4 and earlier NetWin SurgeMail beta 39a WebMail versions 3.1s and earlier

Description The issue allows remote attackers to cause a denial of service, potentially leading to daemon crash, and possibly execute arbitrary code. This is achieved through format string specifiers in the page parameter.

Recommendations For NetWin SurgeMail versions 38k4 and earlier, update to a version later than 38k4 to resolve the issue. For NetWin SurgeMail beta 39a, avoid using the beta version until a stable release is available that addresses the issue. For WebMail versions 3.1s and earlier, update to a version later than 3.1s to mitigate the risk. As a temporary workaround, consider restricting access to the page parameter in the affected API endpoint until a patch is available.

Exploit

Fix

DoS

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2008-1055

Affected Products

Netwin Surgemail

Webmail

References · 12

• 🔥 https://exploit-db.com/exploits/31300 · Exploit
• 🔥 http://securityfocus.com/bid/27990 · Exploit
• http://secunia.com/advisories/29105 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1055 · Security Note
• http://vupen.com/english/advisories/2008/0678 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/40833 · Note
• http://securitytracker.com/id?1019500 · Note
• http://secunia.com/advisories/29137 · Note
• http://securityreason.com/securityalert/3705 · Note
• http://securityfocus.com/archive/1/488741/100/0/threaded · Note
• http://aluigi.altervista.org/adv/surgemailz-adv.txt · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1055 · Note