Published: 15/10/2007 Updated: 29/09/2017

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Integer overflow in eXtremail 2.1.1 and previous versions allows remote malicious users to cause a denial of service, and possibly execute arbitrary code, via a long USER command containing "%s" sequences to the pop3 port (110/tcp), which are expanded to "%%s" before being used in the memmove function, possibly due to an incomplete fix for CVE-2001-1078.

Vulnerable Product	Search on Vulmon	Subscribe to Product
extremail extremail

/* extremail-v4c * * Copyright (c) 2006 by <mu-b@digit-labsorg> * * eXtremail <=211 remote root exploit (x86-lnx) * by mu-b - Sun Oct 08 2006 * * - Tested on: eXtremail 211 (lnx) * * Overflow in LOGIN command of admin interface * * - Private Source Code -DO NOT DISTRIBUTE - * wwwdigit-labsorg/ -- Digit-Labs 2 ...

#!/usr/bin/perl # # extremail-v3pl # # Copyright (c) 2006 by <mu-b@digit-labsorg> # # eXtremail <=211 remote root POC (x86-lnx) # by mu-b - Fri Oct 06 2006 # # Tested on: eXtremail 211 (lnx) # eXtremail 210 (lnx) # # - Private Source Code -DO NOT DISTRIBUTE - # wwwdigit-labsorg/ -- Digit-Labs 2006!@$! ####### ...

#!/usr/bin/perl # # extremail-v8pl # # Copyright (c) 2007 by <mu-b@digit-labsorg> # # eXtremail <=211 remote PoC # by mu-b - Wed Jan 31 2007 # # Tested on: eXtremail 211 (lnx) # eXtremail 210 (lnx) # # - Private Source Code -DO NOT DISTRIBUTE - # wwwdigit-labsorg/ -- Digit-Labs 2007!@$! ######## use Getopt:: ...

/* extremail-v6c * * Copyright (c) 2006 by <mu-b@digit-labsorg> * * eXtremail <=211 remote root exploit (x86-lnx) * by mu-b - Wed Oct 18 2006 * * - Tested on: eXtremail 211 (lnx) * eXtremail 210 (lnx) * * Stack overflow in ifParseAuthPlain * * - Private Source Code -DO NOT DISTRIBUTE - * wwwdigi ...

CWE-189 http://www.securityfocus.com/archive/1/482293 http://www.digit-labs.org/files/exploits/extremail-v3.pl http://www.securityfocus.com/bid/26074 http://secunia.com/advisories/27220 https://www.exploit-db.com/exploits/4532 https://nvd.nist.gov https://www.exploit-db.com/exploits/4533/

CVE-2007-5467

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect