CVE-2001-1078

Format string vulnerability in flog function of eXtremail 1.1.9 and earlier allows remote attackers to gain root privileges via format specifiers in the SMTP commands (1) HELO, (2) EHLO, (3) MAIL FROM, or (4) RCPT TO, and the POP3 commands (5) USER and (6) other commands that can be executed after POP3 authentication.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2001-06/0291.html
http://www.extremail.com/history.htm
http://www.extremail.com/news.htm
http://www.securityfocus.com/bid/2908	Exploit Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6733

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:extremail:extremail:1.0:::::::*
	cpe:2.3:a:extremail:extremail:1.0.1:::::::*
	cpe:2.3:a:extremail:extremail:1.0.2:::::::*
	cpe:2.3:a:extremail:extremail:1.0.3:::::::*
	cpe:2.3:a:extremail:extremail:1.1:::::::*
	cpe:2.3:a:extremail:extremail:1.1.1:::::::*
	cpe:2.3:a:extremail:extremail:1.1.2:::::::*
	cpe:2.3:a:extremail:extremail:1.1.3:::::::*
	cpe:2.3:a:extremail:extremail:1.1.4:::::::*
	cpe:2.3:a:extremail:extremail:1.1.5:::::::*
	cpe:2.3:a:extremail:extremail:1.1.6:::::::*
	cpe:2.3:a:extremail:extremail:1.1.7:::::::*
	cpe:2.3:a:extremail:extremail:1.1.8:::::::*
	cpe:2.3:a:extremail:extremail:1.1.9:::::::*

History

No history.

Information

Published : 2001-06-21 04:00

Updated : 2024-02-04 16:31

NVD link : CVE-2001-1078

Mitre link : CVE-2001-1078

CVE.ORG link : CVE-2001-1078

JSON object : View

Products Affected

extremail

extremail

CWE

NVD-CWE-Other

{"id": "CVE-2001-1078", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2001-06-21T04:00:00.000", "references": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2001-06/0291.html", "source": "cve@mitre.org"}, {"url": "http://www.extremail.com/history.htm", "source": "cve@mitre.org"}, {"url": "http://www.extremail.com/news.htm", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/2908", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6733", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Format string vulnerability in flog function of eXtremail 1.1.9 and earlier allows remote attackers to gain root privileges via format specifiers in the SMTP commands (1) HELO, (2) EHLO, (3) MAIL FROM, or (4) RCPT TO, and the POP3 commands (5) USER and (6) other commands that can be executed after POP3 authentication."}], "lastModified": "2017-12-19T02:29:32.503", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:extremail:extremail:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "72FC40F9-E186-43CA-8C85-EA91A8E91ED1"}, {"criteria": "cpe:2.3:a:extremail:extremail:1.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F395FF0F-8CD2-4653-9C27-5329A37DCC40"}, {"criteria": "cpe:2.3:a:extremail:extremail:1.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37AD1A31-7763-4540-9785-FDC168D7E62E"}, {"criteria": "cpe:2.3:a:extremail:extremail:1.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "20BDB6DF-6570-4AB1-8ACF-D2262C767EFD"}, {"criteria": "cpe:2.3:a:extremail:extremail:1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24C2B718-0D43-4305-9937-705696B6BEFC"}, {"criteria": "cpe:2.3:a:extremail:extremail:1.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C48091F8-7F0D-4FA6-9FC4-2DCC121B368E"}, {"criteria": "cpe:2.3:a:extremail:extremail:1.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E60F2FCF-E439-4321-ABE3-21DAC3ABED3E"}, {"criteria": "cpe:2.3:a:extremail:extremail:1.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F168C99-99C5-4039-A6EB-15D2D094CBA3"}, {"criteria": "cpe:2.3:a:extremail:extremail:1.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD5059DA-D66C-43F5-9DF0-5E9728AB8F22"}, {"criteria": "cpe:2.3:a:extremail:extremail:1.1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10300F83-95C3-4FAB-8918-B72E4AB1B2FF"}, {"criteria": "cpe:2.3:a:extremail:extremail:1.1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0D80F5F-767D-4E01-84BE-3F8418189819"}, {"criteria": "cpe:2.3:a:extremail:extremail:1.1.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEF46411-F100-40B5-A021-09A5292B45F5"}, {"criteria": "cpe:2.3:a:extremail:extremail:1.1.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B40D6E2-4B84-49D6-AC75-E1FBA9E607B1"}, {"criteria": "cpe:2.3:a:extremail:extremail:1.1.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10617FD8-536F-4CA8-996D-7B8746822EF1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}