Detections
Analytics

AXIGEN Mail Server AXIMilter CNHO Command Remote Format String

medium Nessus Plugin ID 30106

Language:

Synopsis

The remote mail service is affected by a format string vulnerability.

Description

The version of AXIMilter installed on the remote host fails to sanitize input of format string identifiers. Using a specially- crafted packet, an unauthenticated, remote attacker can crash the service or possibly execute arbitrary code on the remote host subject to the privileges under which the service operates.

Solution

Either configure AXIMilter to listen only on the loopback interface, which is its default behavior, or allow access only from trusted hosts.

See Also

https://seclists.org/fulldisclosure/2008/Jan/403

Plugin Details

Severity: Medium

ID: 30106

File Name: aximilter_format_string.nasl

Version: 1.16

Type: remote

Published: 1/28/2008

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 5.1

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Reference Information

CVE: CVE-2008-0434

BID: 27363

CWE: 189