GSD-2008-7258

Vulnerability from gsd - Updated: 2023-12-13 01:23
Details
** DISPUTED ** The standardise function in Anibal Monsalve Salazar sSMTP 2.61 and 2.62 allows local users to cause a denial of service (application exit) via an e-mail message containing a long line that begins with a . (dot) character. NOTE: CVE disputes this issue because it is solely a usability problem for senders of messages with certain long lines, and has no security impact.
Aliases
Aliases
CVE-2008-7258
To clipboard 

{
  "GSD": {
    "alias": "CVE-2008-7258",
    "description": "** DISPUTED **  The standardise function in Anibal Monsalve Salazar sSMTP 2.61 and 2.62 allows local users to cause a denial of service (application exit) via an e-mail message containing a long line that begins with a . (dot) character.  NOTE: CVE disputes this issue because it is solely a usability problem for senders of messages with certain long lines, and has no security impact.",
    "id": "GSD-2008-7258"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2008-7258"
      ],
      "details": "** DISPUTED **  The standardise function in Anibal Monsalve Salazar sSMTP 2.61 and 2.62 allows local users to cause a denial of service (application exit) via an e-mail message containing a long line that begins with a . (dot) character.  NOTE: CVE disputes this issue because it is solely a usability problem for senders of messages with certain long lines, and has no security impact.",
      "id": "GSD-2008-7258",
      "modified": "2023-12-13T01:23:01.569785Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2008-7258",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** DISPUTED **  The standardise function in Anibal Monsalve Salazar sSMTP 2.61 and 2.62 allows local users to cause a denial of service (application exit) via an e-mail message containing a long line that begins with a . (dot) character.  NOTE: CVE disputes this issue because it is solely a usability problem for senders of messages with certain long lines, and has no security impact."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "41965",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/41965"
          },
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-7258",
            "refsource": "MISC",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-7258"
          },
          {
            "name": "FEDORA-2010-11811",
            "refsource": "FEDORA",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045422.html"
          },
          {
            "name": "http://patch-tracker.debian.org/patch/series/view/ssmtp/2.62-3/345780-standardise-bufsize",
            "refsource": "CONFIRM",
            "url": "http://patch-tracker.debian.org/patch/series/view/ssmtp/2.62-3/345780-standardise-bufsize"
          },
          {
            "name": "[oss-security] 20100726 Re: CVE-2008-id Request -- ssmtp -- standardise() -- Buffer overflow",
            "refsource": "MLIST",
            "url": "http://marc.info/?l=oss-security\u0026m=128017258305041\u0026w=2"
          },
          {
            "name": "[oss-security] 20100819 Re: CVE-2008-id Request -- ssmtp -- standardise() -- Buffer overflow",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2010/08/19/6"
          },
          {
            "name": "FEDORA-2010-11836",
            "refsource": "FEDORA",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045407.html"
          },
          {
            "name": "41009",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/41009"
          },
          {
            "name": "https://bugs.launchpad.net/ubuntu/+source/ssmtp/+bug/282424",
            "refsource": "CONFIRM",
            "url": "https://bugs.launchpad.net/ubuntu/+source/ssmtp/+bug/282424"
          },
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=582236",
            "refsource": "CONFIRM",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=582236"
          },
          {
            "name": "[oss-security] 20100726 CVE-2008-id Request -- ssmtp -- standardise() -- Buffer overflow",
            "refsource": "MLIST",
            "url": "http://marc.info/?l=oss-security\u0026m=128013391907262\u0026w=2"
          },
          {
            "name": "[oss-security] 20100802 Re: CVE-2008-id Request -- ssmtp -- standardise() -- Buffer overflow",
            "refsource": "MLIST",
            "url": "http://marc.info/?l=oss-security\u0026m=128077707318085\u0026w=2"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:anibal_monsalve_salaz:ssmtp:2.61:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D317E153-4D73-4B96-9B39-29D0CBC3F49D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:anibal_monsalve_salaz:ssmtp:2.62:*:*:*:*:*:*:*",
                    "matchCriteriaId": "575BDF51-0F2C-4F96-8F22-228BC4CDD448",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "The standardise function in Anibal Monsalve Salazar sSMTP 2.61 and 2.62 allows local users to cause a denial of service (application exit) via an e-mail message containing a long line that begins with a . (dot) character.  NOTE: CVE disputes this issue because it is solely a usability problem for senders of messages with certain long lines, and has no security impact"
          },
          {
            "lang": "es",
            "value": "** CUESTIONADA ** La funci\u00f3n standardise en Anibal Monsalve Salazar sSMTP v2.61 y v2.62 permite a usuarios locales provocar una denegaci\u00f3n de servicio (salida de aplicaci\u00f3n) a trav\u00e9s de un mensaje de correo electr\u00f3nio que contenga una l\u00ednea larga que comienza con un caracter . (punto). NOTA: CVE cuetiona este caso porque exclusivamente es un problema de usabilidad para los remitentes de mensajes con determinadas l\u00edneas largas, y no tiene un impacto de seguridad."
          }
        ],
        "id": "CVE-2008-7258",
        "lastModified": "2024-04-11T00:45:02.857",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "LOW",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "LOCAL",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 2.1,
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ]
        },
        "published": "2010-08-20T18:00:02.000",
        "references": [
          {
            "source": "cve@mitre.org",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045407.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045422.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit"
            ],
            "url": "http://marc.info/?l=oss-security\u0026m=128013391907262\u0026w=2"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit"
            ],
            "url": "http://marc.info/?l=oss-security\u0026m=128017258305041\u0026w=2"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://marc.info/?l=oss-security\u0026m=128077707318085\u0026w=2"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch"
            ],
            "url": "http://patch-tracker.debian.org/patch/series/view/ssmtp/2.62-3/345780-standardise-bufsize"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/41009"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2010/08/19/6"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit"
            ],
            "url": "http://www.securityfocus.com/bid/41965"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://bugs.launchpad.net/ubuntu/+source/ssmtp/+bug/282424"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=582236"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-7258"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.