CVE-2008-1055

Published: 27/02/2008 Updated: 11/10/2018

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Format string vulnerability in webmail.exe in NetWin SurgeMail 38k4 and previous versions and beta 39a, and WebMail 3.1s and previous versions, allows remote malicious users to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in the page parameter.

Vulnerable Product	Search on Vulmon	Subscribe to Product
netwin surgemail 3.0c2
netwin surgemail 2.2a6
netwin surgemail 1.8e
netwin surgemail 39a
netwin surgemail 2.0g2
netwin surgemail 2.0e
netwin surgemail 2.1a
netwin surgemail beta 39a
netwin surgemail 2.0c
netwin surgemail 2.2g2
netwin surgemail
netwin surgemail 2.2c10
netwin surgemail 2.2g3
netwin surgemail 1.8d
netwin surgemail 1.8b3
netwin surgemail 2.2c9
netwin surgemail 1.8g3
netwin surgemail 1.8a
netwin surgemail 1.9
netwin surgemail 2.0a2
netwin surgemail 2.1c7
netwin surgemail 3.8f3
netwin webmail
netwin surgemail 1.9b2
netwin surgemail 3.0a

source: wwwsecurityfocuscom/bid/27990/info SurgeMail and WebMail are prone to a remote format-string vulnerability because the applications fail to properly sanitize user-supplied input before including it in the format-specifier argument of a formatted-printing function A remote attacker may execute arbitrary code with the privileges o ...

CWE-134 http://www.securityfocus.com/bid/27990 http://secunia.com/advisories/29105 http://www.securitytracker.com/id?1019500 http://secunia.com/advisories/29137 http://aluigi.altervista.org/adv/surgemailz-adv.txt http://securityreason.com/securityalert/3705 http://www.vupen.com/english/advisories/2008/0678 https://exchange.xforce.ibmcloud.com/vulnerabilities/40833 http://www.securityfocus.com/archive/1/488741/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/31300/

CVE-2008-1055

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect