CVE-2008-1055 : Format string vulnerability in webmail.exe in NetWin SurgeMail 38k4 and earlier

Format string vulnerability in webmail.exe in NetWin SurgeMail 38k4 and earlier and beta 39a, and WebMail 3.1s and earlier, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in the page parameter.

Published 2008-02-27 19:44:00

Updated 2018-10-11 20:29:12

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowExecute codeDenial of service

Products affected by CVE-2008-1055

Netwin » Surgemail
Versions up to, including, (<=) 38k4
cpe:2.3:a:netwin:surgemail:*:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 1.9
cpe:2.3:a:netwin:surgemail:1.9:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 1.9b2
cpe:2.3:a:netwin:surgemail:1.9b2:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 1.8b3
cpe:2.3:a:netwin:surgemail:1.8b3:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 1.8d
cpe:2.3:a:netwin:surgemail:1.8d:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 2.0e
cpe:2.3:a:netwin:surgemail:2.0e:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 2.0g2
cpe:2.3:a:netwin:surgemail:2.0g2:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 2.1a
cpe:2.3:a:netwin:surgemail:2.1a:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 1.8a
cpe:2.3:a:netwin:surgemail:1.8a:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 2.0a2
cpe:2.3:a:netwin:surgemail:2.0a2:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 2.0c
cpe:2.3:a:netwin:surgemail:2.0c:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 1.8g3
cpe:2.3:a:netwin:surgemail:1.8g3:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 2.1c7
cpe:2.3:a:netwin:surgemail:2.1c7:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 2.2a6
cpe:2.3:a:netwin:surgemail:2.2a6:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 1.8e
cpe:2.3:a:netwin:surgemail:1.8e:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 2.2g3
cpe:2.3:a:netwin:surgemail:2.2g3:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 3.0c2
cpe:2.3:a:netwin:surgemail:3.0c2:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 3.8f3
cpe:2.3:a:netwin:surgemail:3.8f3:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 2.2c10
cpe:2.3:a:netwin:surgemail:2.2c10:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 2.2c9
cpe:2.3:a:netwin:surgemail:2.2c9:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 2.2g2
cpe:2.3:a:netwin:surgemail:2.2g2:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 3.0a
cpe:2.3:a:netwin:surgemail:3.0a:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: 39A
cpe:2.3:a:netwin:surgemail:39a:*:*:*:*:*:*:*
Matching versions
Netwin » Surgemail » Version: Beta 39a
cpe:2.3:a:netwin:surgemail:beta_39a:*:*:*:*:*:*:*
Matching versions
Netwin » Webmail
Versions up to, including, (<=) 3.1s
cpe:2.3:a:netwin:webmail:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2008-1055

EPSS FAQ

89.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2008-1055

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2008-1055

CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2008-1055

Jump to

Vulnerability Details : CVE-2008-1055

Products affected by CVE-2008-1055

Exploit prediction scoring system (EPSS) score for CVE-2008-1055

CVSS scores for CVE-2008-1055

CWE ids for CVE-2008-1055

References for CVE-2008-1055