high7.5Public exploit code
CVE-2008-1055
Format string vulnerability in webmail.exe in NetWin SurgeMail 38k4 and earlier and beta 39a, and WebMail 3.1s and earlier, allows remote attackers to cause a …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Surgemail and WebMail 3.0 - 'Page' Remote Format String2008-02-25 · dos · windows · Verified
Impact
Format string vulnerability in webmail.exe in NetWin SurgeMail 38k4 and earlier and beta 39a, and WebMail 3.1s and earlier, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in the page parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Netwin | Surgemail | through 38k4 Versions 1.8a, 1.8b3, 1.8d, 1.8e, 1.8g3 |
| Netwin | Webmail | through 3.1s |
Weakness classification
References
- NVD record
- CVE.org record
- http://aluigi.altervista.org/adv/surgemailz-adv.txt
- http://secunia.com/advisories/29105
- http://secunia.com/advisories/29137
- http://securityreason.com/securityalert/3705
- http://www.securityfocus.com/archive/1/488741/100/0/threaded
- http://www.securityfocus.com/bid/27990
- http://www.securitytracker.com/id?1019500
- http://www.vupen.com/english/advisories/2008/0678
- https://exchange.xforce.ibmcloud.com/vulnerabilities/40833
- http://aluigi.altervista.org/adv/surgemailz-adv.txt
- http://secunia.com/advisories/29105
- http://secunia.com/advisories/29137
- http://securityreason.com/securityalert/3705
- http://www.securityfocus.com/archive/1/488741/100/0/threaded
- http://www.securityfocus.com/bid/27990
- http://www.securitytracker.com/id?1019500
- http://www.vupen.com/english/advisories/2008/0678
- https://exchange.xforce.ibmcloud.com/vulnerabilities/40833