PT-2008-4224 · Spamdyke · Spamdyke

Published 2008-06-19 · Updated 2017-08-08 · CVE-2008-2784

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions spamdyke versions prior to 3.1.8

Description The issue allows remote attackers to use the server as an open mail relay. This is achieved by sending RCPT commands with invalid recipients, followed by a DATA command, then arbitrary RCPT commands, and finally a second DATA command. The smtp filter function fails to filter RCPT commands after encountering the first DATA command.

Recommendations For versions prior to 3.1.8, update to version 3.1.8 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-2784

Affected Products

Spamdyke

References · 5

• http://secunia.com/advisories/30408 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2784 · Security Note
• http://vupen.com/english/advisories/2008/1684/references · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42658 · Note
• http://spamdyke.org/documentation/Changelog.txt · Note