var-200210-0229
Vulnerability from variot

Buffer overflow in the Web Messaging daemon for Ipswitch IMail before 7.12 allows remote attackers to execute arbitrary code via a long HTTP GET request for HTTP/1.0. IMail is a commercial email server software package distributed and maintained by Ipswitch, Incorporated. IMail is available for Microsoft Operating Systems. The web messaging server is vulnerable to a buffer overflow. When the server receives a request for HTTP version 1.0, and the total request is 96 bytes or greater, a buffer overflow occurs. This could result in the execution of attacker-supplied instructions, and potentially allow an attacker to gain local access. ** Ipswitch has reported they are unable to reproduce this issue. In addition, Ipswitch has stated that the supplied, third party patch may in fact open additional vulnerabilities in the product. Ipswitch suggests that users do not apply the supplied patch. IMail's Web Messaging daemon lacks proper checks for parameters when processing HTTP/1.0 GET requests. Remote attackers can exploit this vulnerability to perform buffer overflow attacks

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200210-0229",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "imail",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "ipswitch",
        "version": "7.1"
      },
      {
        "model": "imail",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "ipswitch",
        "version": "7.0.7"
      },
      {
        "model": "imail",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "ipswitch",
        "version": "7.0.6"
      },
      {
        "model": "imail",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "ipswitch",
        "version": "7.0.5"
      },
      {
        "model": "imail",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "ipswitch",
        "version": "7.0.4"
      },
      {
        "model": "imail",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "ipswitch",
        "version": "7.0.3"
      },
      {
        "model": "imail",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "ipswitch",
        "version": "7.0.2"
      },
      {
        "model": "imail",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "ipswitch",
        "version": "7.0.1"
      },
      {
        "model": "imail",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "ipswitch",
        "version": "6.4"
      },
      {
        "model": "imail",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "ipswitch",
        "version": "6.3"
      },
      {
        "model": "imail",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "ipswitch",
        "version": "6.2"
      },
      {
        "model": "imail",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "ipswitch",
        "version": "6.1"
      },
      {
        "model": "imail",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ipswitch",
        "version": "7.12"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "5323"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200210-145"
      },
      {
        "db": "NVD",
        "id": "CVE-2002-1076"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "2c79cbe14ac7d0b8472d3f129fa1df\u203b c79cbe14ac7d0b8472d3f129fa1df55@yahoo.com",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200210-145"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2002-1076",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2002-1076",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 1.0,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-5464",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2002-1076",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200210-145",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-5464",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-5464"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200210-145"
      },
      {
        "db": "NVD",
        "id": "CVE-2002-1076"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Buffer overflow in the Web Messaging daemon for Ipswitch IMail before 7.12 allows remote attackers to execute arbitrary code via a long HTTP GET request for HTTP/1.0. IMail is a commercial email server software package distributed and maintained by Ipswitch, Incorporated.  IMail is available for Microsoft Operating Systems. \nThe web messaging server is vulnerable to a buffer overflow.  When the server receives a request for HTTP version 1.0, and the total request is 96 bytes or greater, a buffer overflow occurs.  This could result in the execution of attacker-supplied instructions, and potentially allow an attacker to gain local access. \n** Ipswitch has reported they are unable to reproduce this issue. In addition, Ipswitch has stated that the supplied, third party patch may in fact open additional vulnerabilities in the product. Ipswitch suggests that users do not apply the supplied patch. IMail\u0027s Web Messaging daemon lacks proper checks for parameters when processing HTTP/1.0 GET requests. Remote attackers can exploit this vulnerability to perform buffer overflow attacks",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2002-1076"
      },
      {
        "db": "BID",
        "id": "5323"
      },
      {
        "db": "VULHUB",
        "id": "VHN-5464"
      }
    ],
    "trust": 1.26
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-5464",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-5464"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "5323",
        "trust": 2.0
      },
      {
        "db": "NVD",
        "id": "CVE-2002-1076",
        "trust": 1.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200210-145",
        "trust": 0.7
      },
      {
        "db": "BUGTRAQ",
        "id": "20020725 IPSWITCH IMAIL ADVISORY/EXPLOIT/PATCH",
        "trust": 0.6
      },
      {
        "db": "BUGTRAQ",
        "id": "20020729 HOAX EXPLOIT",
        "trust": 0.6
      },
      {
        "db": "BUGTRAQ",
        "id": "20020729 RE: HOAX EXPLOIT (2C79CBE14AC7D0B8472D3F129FA1DF55 RETURNS)",
        "trust": 0.6
      },
      {
        "db": "XF",
        "id": "9679",
        "trust": 0.6
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-75478",
        "trust": 0.1
      },
      {
        "db": "EXPLOIT-DB",
        "id": "21654",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-5464",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-5464"
      },
      {
        "db": "BID",
        "id": "5323"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200210-145"
      },
      {
        "db": "NVD",
        "id": "CVE-2002-1076"
      }
    ]
  },
  "id": "VAR-200210-0229",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-5464"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-22T22:57:15.393000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2002-1076"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.7,
        "url": "http://www.securityfocus.com/bid/5323"
      },
      {
        "trust": 2.7,
        "url": "http://archives.neohapsis.com/archives/bugtraq/2002-07/0326.html"
      },
      {
        "trust": 2.7,
        "url": "http://archives.neohapsis.com/archives/bugtraq/2002-07/0363.html"
      },
      {
        "trust": 2.7,
        "url": "http://archives.neohapsis.com/archives/bugtraq/2002-07/0368.html"
      },
      {
        "trust": 2.7,
        "url": "http://support.ipswitch.com/kb/im-20020729-dm01.htm"
      },
      {
        "trust": 2.7,
        "url": "http://support.ipswitch.com/kb/im-20020731-dm02.htm"
      },
      {
        "trust": 2.7,
        "url": "http://www.iss.net/security_center/static/9679.php"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-5464"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200210-145"
      },
      {
        "db": "NVD",
        "id": "CVE-2002-1076"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-5464"
      },
      {
        "db": "BID",
        "id": "5323"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200210-145"
      },
      {
        "db": "NVD",
        "id": "CVE-2002-1076"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2002-10-04T00:00:00",
        "db": "VULHUB",
        "id": "VHN-5464"
      },
      {
        "date": "2002-07-26T00:00:00",
        "db": "BID",
        "id": "5323"
      },
      {
        "date": "2002-07-26T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200210-145"
      },
      {
        "date": "2002-10-04T04:00:00",
        "db": "NVD",
        "id": "CVE-2002-1076"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2008-09-05T00:00:00",
        "db": "VULHUB",
        "id": "VHN-5464"
      },
      {
        "date": "2002-07-26T00:00:00",
        "db": "BID",
        "id": "5323"
      },
      {
        "date": "2005-05-02T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200210-145"
      },
      {
        "date": "2024-11-20T23:40:32.110000",
        "db": "NVD",
        "id": "CVE-2002-1076"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200210-145"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "IPSwitch IMail Web Messaging Daemon HTTP GET Remote buffer overflow vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200210-145"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "unknown",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200210-145"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.