CVE-2008-1497 Stack-based buffer overflow in the IMAP service in NetWin SurgeMail 38k4-4 and earlier allows remote authenticated users to execute arbitrary code via long arguments to the LSUB command.
HighCVSS 9.0
EPSS 6.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in the IMAP service in NetWin SurgeMail 38k4-4 and earlier allows remote authenticated users to execute arbitrary code via long arguments to the LSUB command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netwin surgemail | = 1.8g3 | No fix listed |
| netwin surgemail | = 1.9b2 | No fix listed |
| netwin surgemail | = 2.0a2 | No fix listed |
| netwin surgemail | = 2.0c | No fix listed |
| netwin surgemail | = 2.0e | No fix listed |
| netwin surgemail | = 2.0g2 | No fix listed |
| netwin surgemail | = 2.1c7 | No fix listed |
| netwin surgemail | = 2.2a6 | No fix listed |
| netwin surgemail | = 2.2c10 | No fix listed |
| netwin surgemail | = 2.2g2 | No fix listed |
| netwin surgemail | = 2.2g3 | No fix listed |
| netwin surgemail | = 3.0a | No fix listed |
| netwin surgemail | = 3.0c2 | No fix listed |
| netwin surgemail | = 3.2e | No fix listed |
| netwin surgemail | = 3.5a | No fix listed |
| netwin surgemail | = 3.5b3 | No fix listed |
| netwin surgemail | = 3.6d | No fix listed |
| netwin surgemail | = 3.6f3 | No fix listed |
| netwin surgemail | = 3.6f5 | No fix listed |
| netwin surgemail | = 3.6f7 | No fix listed |
| netwin surgemail | = 3.7b | No fix listed |
| netwin surgemail | = 3.7b3 | No fix listed |
| netwin surgemail | = 3.7b5 | No fix listed |
| netwin surgemail | = 3.7b6 | No fix listed |
| netwin surgemail | = 3.7b7 | No fix listed |
Show 14 more
| Product | Affected versions | Fixed in |
|---|---|---|
| netwin surgemail | = 3.7b8 | No fix listed |
| netwin surgemail | = 3.8a | No fix listed |
| netwin surgemail | = 3.8b | No fix listed |
| netwin surgemail | = 3.8d | No fix listed |
| netwin surgemail | = 3.8f | No fix listed |
| netwin surgemail | = 3.8f2 | No fix listed |
| netwin surgemail | = 3.8f3 | No fix listed |
| netwin surgemail | = 3.8i | No fix listed |
| netwin surgemail | = 3.8i2 | No fix listed |
| netwin surgemail | = 3.8i3 | No fix listed |
| netwin surgemail | = 3.8k | No fix listed |
| netwin surgemail | = 3.8k2 | No fix listed |
| netwin surgemail | = 3.8k3 | No fix listed |
| netwin surgemail | = 3.8m | No fix listed |
References
- 29105 third-party-advisory vendor-advisory
- 3774 exploit third-party-advisory
- www.infigo.hr exploit
- www.netwinsite.com vendor-advisory
- 20080321 [INFIGO-2008-03-07]: Surgemail 38k4 IMAP server remote stack overflow mailing-list
- 28377 exploit vdb-entry
- surgemail-imap-lsub-bo(41402) vdb-entry