Detections
Analytics

Magic Winmail Server PASS Command Remote Format String

high Nessus Plugin ID 11742

Language:

Synopsis

The remote mail server is prone to a format string attack.

Description

The remote Winmail POP server, according to its banner, is vulnerable to a format string attack when processing the USER command.

An unauthenticated attacker may use this flaw to execute arbitrary code on this host.

Solution

Upgrade to WinMail version 2.4 (Build 0530) or later.

See Also

https://seclists.org/bugtraq/2003/May/251

http://www.magicwinmail.net/changelog.asp

Plugin Details

Severity: High

ID: 11742

File Name: magic_winmail_pop_format_string.nasl

Version: 1.16

Type: remote

Agent: windows

Family: Windows

Published: 6/17/2003

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/30/2003

Vulnerability Publication Date: 5/25/2003

Reference Information

CVE: CVE-2003-0391

BID: 7667