Vulnerability Details : CVE-2008-2240
Public exploit exists!
Stack-based buffer overflow in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long Accept-Language HTTP header.
Vulnerability category: OverflowExecute codeDenial of service
Products affected by CVE-2008-2240
- cpe:2.3:a:ibm:lotus_domino:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:lotus_domino:6.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:lotus_domino:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:lotus_domino:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:lotus_domino:8.0.1:*:*:*:*:*:*:*
Threat overview for CVE-2008-2240
Top countries where our scanners detected CVE-2008-2240
Top open port discovered on systems with this issue
110
IPs affected by CVE-2008-2240 68
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2008-2240!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2008-2240
97.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2008-2240
-
IBM Lotus Domino Web Server Accept-Language Stack Buffer Overflow
Disclosure Date: 2008-05-20First seen: 2020-04-26exploit/windows/lotus/domino_http_accept_languageThis module exploits a stack buffer overflow in IBM Lotus Domino Web Server prior to version 7.0.3FP1 and 8.0.1. This flaw is triggered by any HTTP request with an Accept-Language header greater than 114 bytes. Authors: - Fairuzan Roslan <riaf@mysec.org> - Earl
CVSS scores for CVE-2008-2240
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
CWE ids for CVE-2008-2240
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2008-2240
-
http://www.securityfocus.com/bid/29310
IBM Lotus Domino Web Server 'Accept Language' HTTP Header Buffer Overflow Vulnerability
-
http://www.vupen.com/english/advisories/2008/1597
-
http://www.attrition.org/pipermail/vim/2008-May/001988.html
-
http://www-1.ibm.com/support/docview.wss?uid=swg21303057
Patch
-
http://www.mwrinfosecurity.com/publications/mwri_ibm-lotus-domino-accept-language-stack-overflow_2008-05-20.pdf
Patch
-
http://www.securitytracker.com/id?1020098
-
http://www.attrition.org/pipermail/vim/2008-May/001989.html
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/42552
Jump to