CVE-2008-1055

Published: Feb 27, 2008Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Format string vulnerability in webmail.exe in NetWin SurgeMail 38k4 and earlier and beta 39a, and WebMail 3.1s and earlier, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in the page parameter.

Affected (25)

Products: Netwin: Surgemail, Webmail

2 products

Configuration A

25 vulnerable

Vulnerable Software	Affected Versions
Netwin Surgemail	Up to 38k4
Netwin Surgemail	Version 1.8a
Netwin Surgemail	Version 1.8b3
Netwin Surgemail	Version 1.8d
Netwin Surgemail	Version 1.8e
Netwin Surgemail	Version 1.8g3
Netwin Surgemail	Version 1.9
Netwin Surgemail	Version 1.9b2
Netwin Surgemail	Version 2.0a2
Netwin Surgemail	Version 2.0c
Netwin Surgemail	Version 2.0e
Netwin Surgemail	Version 2.0g2
Netwin Surgemail	Version 2.1a
Netwin Surgemail	Version 2.1c7
Netwin Surgemail	Version 2.2a6
Netwin Surgemail	Version 2.2c10
Netwin Surgemail	Version 2.2c9
Netwin Surgemail	Version 2.2g2
Netwin Surgemail	Version 2.2g3
Netwin Surgemail	Version 3.0a
Netwin Surgemail	Version 3.0c2
Netwin Surgemail	Version 3.8f3
Netwin Surgemail	Version 39a
Netwin Surgemail	Version beta_39a
Netwin Webmail	Up to 3.1s

Related CWEs

Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

References (18)

http://aluigi.altervista.org/adv/surgemailz-adv.txt

Source: cve@mitre.org

http://secunia.com/advisories/29105

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29137

Source: cve@mitre.org

http://securityreason.com/securityalert/3705

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/488741/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/27990

Source: cve@mitre.org

Exploit

http://www.securitytracker.com/id?1019500

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/0678

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/40833

Source: cve@mitre.org

http://aluigi.altervista.org/adv/surgemailz-adv.txt

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/29105

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/29137

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/securityalert/3705

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/488741/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/27990

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.securitytracker.com/id?1019500

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2008/0678

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/40833

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.