CVE-2008-1497: Buffer Overflow

Published Mar 25, 2008

Updated

Stack-based buffer overflow in the IMAP service in NetWin SurgeMail 38k4-4 and earlier allows remote authenticated users to execute arbitrary code via long arguments to the LSUB command.

Affected Software

39 affected components

Netwin Surgemail=1.8g3

Netwin Surgemail=1.9b2

Netwin Surgemail=2.0a2

Netwin Surgemail=2.0c

Netwin Surgemail=2.0e

Netwin Surgemail=2.0g2

Netwin Surgemail=2.1c7

Netwin Surgemail=2.2a6

Netwin Surgemail=2.2c10

Netwin Surgemail=2.2g2

Netwin Surgemail=2.2g3

Netwin Surgemail=3.0a

Netwin Surgemail=3.0c2

Netwin Surgemail=3.2e

Netwin Surgemail=3.5a

Netwin Surgemail=3.5b3

Netwin Surgemail=3.6d

Netwin Surgemail=3.6f3

Netwin Surgemail=3.6f5

Netwin Surgemail=3.6f7

Netwin Surgemail=3.7b

Netwin Surgemail=3.7b3

Netwin Surgemail=3.7b5

Netwin Surgemail=3.7b6

Netwin Surgemail=3.7b7

Netwin Surgemail=3.7b8

Netwin Surgemail=3.8a

Netwin Surgemail=3.8b

Netwin Surgemail=3.8d

Netwin Surgemail=3.8f

Netwin Surgemail=3.8f2

Netwin Surgemail=3.8f3

Netwin Surgemail=3.8i

Netwin Surgemail=3.8i2

Netwin Surgemail=3.8i3

Netwin Surgemail=3.8k

Netwin Surgemail=3.8k2

Netwin Surgemail=3.8k3

Netwin Surgemail=3.8m

Event History

Mar 25, 2008

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-1497?

CVE-2008-1497 is a critical vulnerability due to a stack-based buffer overflow that can allow remote authenticated users to execute arbitrary code.

How do I fix CVE-2008-1497?

To fix CVE-2008-1497, upgrade to a version of NetWin SurgeMail that is not affected by this vulnerability.

What versions of SurgeMail are affected by CVE-2008-1497?

Versions of SurgeMail from 38k4-4 and earlier are affected by CVE-2008-1497.

Can CVE-2008-1497 be exploited remotely?

Yes, CVE-2008-1497 can be exploited remotely by authenticated users through long arguments to the LSUB command.

What types of systems are at risk from CVE-2008-1497?

Systems running affected versions of NetWin SurgeMail, especially those allowing remote authenticated access, are at risk from CVE-2008-1497.