high7.5Public exploit code
CVE-2004-2677
Format string vulnerability in qwik-smtpd.c in QwikMail SMTP (qwik-smtpd) 0.3 and earlier allows remote attackers to execute arbitrary code via format specifie…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Qwik SMTP 0.3 - Format String2004-11-09 · remote · linux · Verified
Impact
Format string vulnerability in qwik-smtpd.c in QwikMail SMTP (qwik-smtpd) 0.3 and earlier allows remote attackers to execute arbitrary code via format specifiers in the (1) clientRcptTo array, and the (2) Received and (3) messageID variables, possibly involving HELO and hostname arguments.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Qwikmail | Qwikmail Smtp | Version 0.3 |
References
- NVD record
- CVE.org record
- http://qwikmail.sourceforge.net/smtpd/qwik-smtpd-0.3.patch
- http://secunia.com/advisories/13037
- http://securitytracker.com/id?1012016
- http://unl0ck.info/advisories/qwik-smtpd.txt
- http://www.securityfocus.com/archive/1/460600/100/0/threaded
- http://www.securityfocus.com/bid/11572
- http://www.vupen.com/english/advisories/2007/0687
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17917
- http://qwikmail.sourceforge.net/smtpd/qwik-smtpd-0.3.patch
- http://secunia.com/advisories/13037
- http://securitytracker.com/id?1012016
- http://unl0ck.info/advisories/qwik-smtpd.txt
- http://www.securityfocus.com/archive/1/460600/100/0/threaded
- http://www.securityfocus.com/bid/11572
- http://www.vupen.com/english/advisories/2007/0687
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17917