vendor:
WebMail, SurgeMail
by:
SecurityFocus
7.5
CVSS
HIGH
Format-String Vulnerability
134
CWE
Product Name: WebMail, SurgeMail
Affected Version From: SurgeMail 38k4, beta 39a and earlier, Netwin WebMail 3.1s and earlier
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
SurgeMail and WebMail Remote Format-String Vulnerability
SurgeMail and WebMail are prone to a remote format-string vulnerability because the applications fail to properly sanitize user-supplied input before including it in the format-specifier argument of a formatted-printing function. A remote attacker may execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will result in a denial of service.
Mitigation:
Input validation should be used to ensure that untrusted input is not used to construct format strings passed to formatted-printing functions.
