CVE-2005-2931

Format string vulnerability in the SMTP service in IMail Server 8.20 in Ipswitch Collaboration Suite (ICS) before 2.02 allows remote attackers to execute arbitrary code via format string specifiers to the (1) EXPN, (2) MAIL, (3) MAIL FROM, and (4) RCPT TO commands.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/17863
http://securitytracker.com/id?1015317
http://www.idefense.com/application/poi/display?id=346&type=vulnerabilities	Patch Vendor Advisory
http://www.ipswitch.com/support/imail/releases/imail_professional/im822.asp	Patch
http://www.securityfocus.com/bid/15752
http://www.vupen.com/english/advisories/2005/2782

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ipswitch:imail_server:8.20:::::::*
	cpe:2.3:a:ipswitch:ipswitch_collaboration_suite:2.0:::::::*
	cpe:2.3:a:ipswitch:ipswitch_collaboration_suite:2.01:::::::*

History

No history.

Information

Published : 2005-12-07 01:03

Updated : 2023-12-10 10:28

NVD link : CVE-2005-2931

Mitre link : CVE-2005-2931

CVE.ORG link : CVE-2005-2931

JSON object : View

Products Affected

ipswitch

ipswitch_collaboration_suite
imail_server

CWE

NVD-CWE-Other

{"id": "CVE-2005-2931", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": true, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2005-12-07T01:03:00.000", "references": [{"url": "http://secunia.com/advisories/17863", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1015317", "source": "cve@mitre.org"}, {"url": "http://www.idefense.com/application/poi/display?id=346&type=vulnerabilities", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.ipswitch.com/support/imail/releases/imail_professional/im822.asp", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/15752", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2005/2782", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Format string vulnerability in the SMTP service in IMail Server 8.20 in Ipswitch Collaboration Suite (ICS) before 2.02 allows remote attackers to execute arbitrary code via format string specifiers to the (1) EXPN, (2) MAIL, (3) MAIL FROM, and (4) RCPT TO commands."}], "lastModified": "2011-03-08T02:25:18.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ipswitch:imail_server:8.20:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "188ADF5A-00A4-4608-A9F9-EDF61CEFAA20"}, {"criteria": "cpe:2.3:a:ipswitch:ipswitch_collaboration_suite:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEC4E630-46A4-4C8F-9D73-F8B7241F4795"}, {"criteria": "cpe:2.3:a:ipswitch:ipswitch_collaboration_suite:2.01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59B7AA85-5A6A-4D40-8ACA-26A6C2FBDACC"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}