CVE-2008-7074 Format string vulnerability in MemeCode Software i.Scribe 1.88 through 2.00 before Beta9 allows remote SMTP servers to cause a denial of service (crash) and possibly execute arbitrary code via format....
HighCVSS 9.3
EPSS 4.9%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Format string vulnerability in MemeCode Software i.Scribe 1.88 through 2.00 before Beta9 allows remote SMTP servers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in a server response, which is not properly handled "when displaying the signon message."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| memcode i.scribe | = 1.88 | No fix listed |
| memcode i.scribe | = 1.89 | No fix listed |
| memcode i.scribe | = 1.90 | No fix listed |
| memcode i.scribe | = 2.00-alpha1 | No fix listed |
| memcode i.scribe | = 2.00-alpha2 | No fix listed |
| memcode i.scribe | = 2.00-alpha3 | No fix listed |
| memcode i.scribe | = 2.00-alpha4 | No fix listed |
| memcode i.scribe | = 2.00-beta10 | No fix listed |
| memcode i.scribe | = 2.00-beta11 | No fix listed |
| memcode i.scribe | = 2.00-beta6 | No fix listed |
| memcode i.scribe | = 2.00-beta7 | No fix listed |
| memcode i.scribe | = 2.00-beta8 | No fix listed |
| memcode i.scribe | = 2.00-beta9 | No fix listed |
References
- memecode.com
- 50232 vdb-entry
- 32906 third-party-advisory vendor-advisory
- 32497 exploit vdb-entry
- iscribe-smtp-format-string(46970) vdb-entry
- 7249 exploit