SurgeMail Remote Format String Vulnerability

Bugtraq ID:	24871
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 19 2007 12:00AM
Updated:	Jul 12 2007 03:17AM
Credit:	Nico Leidecker reported this issue.
Vulnerable:	SurgeMail SurgeMail For Linux 3.7b8
Not Vulnerable:	SurgeMail SurgeMail For Linux 38i3

SurgeMail Remote Format String Vulnerability

SurgeMail is prone to a remote format-string vulnerability because the application fails to properly sanitize user-supplied input before including it in the format-specifier argument of a formatted-printing function.

A remote attacker may execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will result in a denial of service.

This issue affects SurgeMail for Linux 3.7b8; prior versions may also be vulnerable.

SurgeMail Remote Format String Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

SurgeMail Remote Format String Vulnerability

Solution:
The vendor has released version 38i3 to address this issue. Please see the references for more information.


SurgeMail SurgeMail For Linux 3.7b8

• SurgeMail surgemail_38i3_linux.tar.gz
  http://netwinsite.com/ftp/surgemail/surgemail_38i3_linux.tar.gz

SurgeMail Remote Format String Vulnerability

References:

• SurgeMail Homepage (Netwin)