CVE-2007-5466
Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending multiple long strings to the IMAP port (143/tcp); (2) execute arbitrary code via a long string in an IMAP AUTHENTICATE PLAIN action,…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 19.9%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending multiple long strings to the IMAP port (143/tcp); (2) execute arbitrary code via a long string in an IMAP AUTHENTICATE PLAIN action, involving the ifParseAuthPlain function; (3) execute arbitrary code via a long LOGIN command to the admin interface port (4501/tcp); or (4) execute arbitrary code via a long string in an IMAP AUTHENTICATE LOGIN (aka CRAM-MD5 authentication) action, involving the ifProcImapAuth1 function.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 19.89% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- extremail/extremail
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/27220Vendor Advisory
- http://www.digit-labs.org/files/exploits/extremail-v4.c
- http://www.digit-labs.org/files/exploits/extremail-v5.c
- http://www.digit-labs.org/files/exploits/extremail-v6.c
- http://www.digit-labs.org/files/exploits/extremail-v8.pl
- http://www.securityfocus.com/archive/1/482293
- http://www.securityfocus.com/bid/26074
- https://exchange.xforce.ibmcloud.com/vulnerabilities/37209
- https://www.exploit-db.com/exploits/4533
- https://www.exploit-db.com/exploits/4534
- https://www.exploit-db.com/exploits/4535
- http://secunia.com/advisories/27220Vendor Advisory
- http://www.digit-labs.org/files/exploits/extremail-v4.c
- http://www.digit-labs.org/files/exploits/extremail-v5.c
- http://www.digit-labs.org/files/exploits/extremail-v6.c
- http://www.digit-labs.org/files/exploits/extremail-v8.pl
- http://www.securityfocus.com/archive/1/482293
- http://www.securityfocus.com/bid/26074
- https://exchange.xforce.ibmcloud.com/vulnerabilities/37209
- https://www.exploit-db.com/exploits/4533
- https://www.exploit-db.com/exploits/4534
- https://www.exploit-db.com/exploits/4535
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.