{"api_version":"1","generated_at":"2026-07-23T06:03:12+00:00","cve":"CVE-2008-2499","urls":{"html":"https://cve.report/CVE-2008-2499","api":"https://cve.report/api/cve/CVE-2008-2499.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-2499","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-2499"},"summary":{"title":"CVE-2008-2499","description":"Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code via a crafted URL.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-05-29 16:32:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-119","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.zerodayinitiative.com/advisories/ZDI-08-028/","name":"http://www.zerodayinitiative.com/advisories/ZDI-08-028/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Zero Day Initiative","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21303920","name":"http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21303920","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"IBM notice: The page you requested cannot be displayed","mime":"text/html","httpstatus":"404","archivestatus":"410"},{"url":"http://secunia.com/advisories/30309","name":"http://secunia.com/advisories/30309","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"IBM Lotus Sametime Community Services Multiplexer Buffer Overflow - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/29328","name":"http://www.securityfocus.com/bid/29328","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"],"title":"IBM Lotus Sametime Multiplexer Buffer Overflow Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.vupen.com/english/advisories/2008/1595/references","name":"http://www.vupen.com/english/advisories/2008/1595/references","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1020093","name":"http://www.securitytracker.com/id?1020093","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Lotus Sametime Stack Overflow in Community Services MUX Lets Remote Users Execute Arbitrary Code - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42575","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42575","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-2499","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-2499","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"2499","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_sametime","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"2499","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_sametime","cpe6":"7.5.1","cpe7":"cf1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"2499","vulnerable":"1","versionEndIncluding":"7.5","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_sametime","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T09:05:29.736Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.zerodayinitiative.com/advisories/ZDI-08-028/"},{"name":"1020093","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1020093"},{"name":"sametime-stmux-bo(42575)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42575"},{"name":"ADV-2008-1595","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/1595/references"},{"name":"29328","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/29328"},{"name":"30309","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/30309"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21303920"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-05-21T00:00:00.000Z","descriptions":[{"lang":"en","value":"Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code via a crafted URL."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-07T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://www.zerodayinitiative.com/advisories/ZDI-08-028/"},{"name":"1020093","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1020093"},{"name":"sametime-stmux-bo(42575)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42575"},{"name":"ADV-2008-1595","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/1595/references"},{"name":"29328","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/29328"},{"name":"30309","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/30309"},{"tags":["x_refsource_CONFIRM"],"url":"http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21303920"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-2499","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code via a crafted URL."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://www.zerodayinitiative.com/advisories/ZDI-08-028/","refsource":"MISC","url":"http://www.zerodayinitiative.com/advisories/ZDI-08-028/"},{"name":"1020093","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1020093"},{"name":"sametime-stmux-bo(42575)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42575"},{"name":"ADV-2008-1595","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/1595/references"},{"name":"29328","refsource":"BID","url":"http://www.securityfocus.com/bid/29328"},{"name":"30309","refsource":"SECUNIA","url":"http://secunia.com/advisories/30309"},{"name":"http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21303920","refsource":"CONFIRM","url":"http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21303920"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-2499","datePublished":"2008-05-29T16:00:00.000Z","dateReserved":"2008-05-29T00:00:00.000Z","dateUpdated":"2024-08-07T09:05:29.736Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-05-29 16:32:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-119","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_sametime:*:*:*:*:*:*:*:*","versionEndIncluding":"7.5","matchCriteriaId":"9D250D7E-88E7-46B7-8C63-C067D9889A76"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_sametime:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0","versionEndExcluding":"8.0.1","matchCriteriaId":"A811D9B9-99EF-4324-87ED-F13A311EAB67"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_sametime:7.5.1:cf1:*:*:*:*:*:*","matchCriteriaId":"F8A12AF0-F301-4661-AD90-21077BF203B9"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"2499","Ordinal":"1","Title":"CVE-2008-2499","CVE":"CVE-2008-2499","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"2499","Ordinal":"1","NoteData":"Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code via a crafted URL.","Type":"Description","Title":"CVE-2008-2499"},{"CveYear":"2008","CveId":"2499","Ordinal":"2","NoteData":"2008-05-29","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"2499","Ordinal":"3","NoteData":"2017-08-07","Type":"Other","Title":"Modified"}]}}}