var-200411-0057
Vulnerability from variot

Buffer overflow in the Lightweight Directory Access Protocol (LDAP) daemon (iLDAP.exe 3.9.15.10) in Ipswitch IMail Server 8.03 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via an LDAP message with a large tag length. Ipswitch, Inc. of Ipswitch Imail Exists in unspecified vulnerabilities.None. The Ipswitch LDAP daemon has been reported prone to a remote buffer overflow vulnerability. The vulnerability exists due to a lack of sufficient boundary checks performed on user supplied LDAP tags. When attacker-supplied data containing large LDAP tags is processed by the affected service, a stack based buffer overflow condition will be triggered. A remote attacker may exploit this condition to execute arbitrary instructions in the security context of the affected service. Ipswitch IMail server is a WEB-based mail solution. The Ipswitch LDAP daemon does not adequately check user-supplied LDAP tokens. The LDAP message is composed of the length and content of the tag. The following tags 0x02 0x03 0x0A 0x25 0xBD represent integers 665, 501 (0xA25BD). If the length tag provided by the attacker is too long, the data provided by the user will be copied according to the tag length when the program is processed. Lack of sufficient bounds checks, may overwrite the memory address in the stack due to the following assembly specification: .text: 00401188 mov byte ptr [ebp+ecx+var_4], dl Carefully submitted copy data may be executed on the system with LDAP daemon process privileges Arbitrary instructions

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200411-0057",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "imail",
        "scope": "eq",
        "trust": 2.7,
        "vendor": "ipswitch",
        "version": "8.0.5"
      },
      {
        "model": "imail",
        "scope": "eq",
        "trust": 2.7,
        "vendor": "ipswitch",
        "version": "8.0.3"
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "ipswitch",
        "version": null
      },
      {
        "model": "imail",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "ipswitch",
        "version": null
      },
      {
        "model": "imail",
        "scope": null,
        "trust": 0.8,
        "vendor": "ipswitch",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#972334"
      },
      {
        "db": "BID",
        "id": "9682"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2004-000790"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200411-149"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0297"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "iDEFENSE Labs\u203b labs@idefense.com",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200411-149"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2004-0297",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2004-0297",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "VHN-8727",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2004-0297",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CARNEGIE MELLON",
            "id": "VU#972334",
            "trust": 0.8,
            "value": "38.48"
          },
          {
            "author": "NVD",
            "id": "CVE-2004-0297",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200411-149",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-8727",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#972334"
      },
      {
        "db": "VULHUB",
        "id": "VHN-8727"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2004-000790"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200411-149"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0297"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Buffer overflow in the Lightweight Directory Access Protocol (LDAP) daemon (iLDAP.exe 3.9.15.10) in Ipswitch IMail Server 8.03 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via an LDAP message with a large tag length. Ipswitch, Inc. of Ipswitch Imail Exists in unspecified vulnerabilities.None. The Ipswitch LDAP daemon has been reported prone to a remote buffer overflow vulnerability. The vulnerability exists due to a lack of sufficient boundary checks performed on user supplied LDAP tags. When attacker-supplied data containing large LDAP tags is processed by the affected service, a stack based buffer overflow condition will be triggered. A remote attacker may exploit this condition to execute arbitrary instructions in the security context of the affected service. Ipswitch IMail server is a WEB-based mail solution. The Ipswitch LDAP daemon does not adequately check user-supplied LDAP tokens. The LDAP message is composed of the length and content of the tag. The following tags 0x02 0x03 0x0A 0x25 0xBD represent integers 665, 501 (0xA25BD). If the length tag provided by the attacker is too long, the data provided by the user will be copied according to the tag length when the program is processed. Lack of sufficient bounds checks, may overwrite the memory address in the stack due to the following assembly specification: .text: 00401188 mov byte ptr [ebp+ecx+var_4], dl Carefully submitted copy data may be executed on the system with LDAP daemon process privileges Arbitrary instructions",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2004-0297"
      },
      {
        "db": "CERT/CC",
        "id": "VU#972334"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2004-000790"
      },
      {
        "db": "BID",
        "id": "9682"
      },
      {
        "db": "VULHUB",
        "id": "VHN-8727"
      }
    ],
    "trust": 2.7
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-8727",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-8727"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#972334",
        "trust": 3.3
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0297",
        "trust": 3.3
      },
      {
        "db": "BID",
        "id": "9682",
        "trust": 2.8
      },
      {
        "db": "OSVDB",
        "id": "3984",
        "trust": 1.7
      },
      {
        "db": "SECUNIA",
        "id": "10880",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2004-000790",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200411-149",
        "trust": 0.7
      },
      {
        "db": "IDEFENSE",
        "id": "20040217 IPSWITCH IMAIL LDAP DAEMON REMOTE BUFFER OVERFLOW",
        "trust": 0.6
      },
      {
        "db": "XF",
        "id": "15243",
        "trust": 0.6
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-71326",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "83017",
        "trust": 0.1
      },
      {
        "db": "EXPLOIT-DB",
        "id": "157",
        "trust": 0.1
      },
      {
        "db": "EXPLOIT-DB",
        "id": "16824",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-8727",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#972334"
      },
      {
        "db": "VULHUB",
        "id": "VHN-8727"
      },
      {
        "db": "BID",
        "id": "9682"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2004-000790"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200411-149"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0297"
      }
    ]
  },
  "id": "VAR-200411-0057",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-8727"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-08-14T14:29:27.650000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      },
      {
        "problemtype": "others (CWE-Other) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2004-000790"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0297"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "http://www.securityfocus.com/bid/9682"
      },
      {
        "trust": 2.5,
        "url": "http://www.kb.cert.org/vuls/id/972334"
      },
      {
        "trust": 2.5,
        "url": "http://www.idefense.com/application/poi/display?id=74"
      },
      {
        "trust": 1.9,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15243"
      },
      {
        "trust": 1.7,
        "url": "http://www.ipswitch.com/support/imail/releases/imail_professional/im805hf2.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.osvdb.org/3984"
      },
      {
        "trust": 0.8,
        "url": "http://www.idefense.com/application/poi/display?id=74\u0026type=vulnerabilities"
      },
      {
        "trust": 0.8,
        "url": "http://secunia.com/advisories/10880/"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2004-0297"
      },
      {
        "trust": 0.6,
        "url": "http://xforce.iss.net/xforce/xfdb/15243"
      },
      {
        "trust": 0.3,
        "url": "http://www.ipswitch.com/products/imail_server/index.asp"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/354237"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#972334"
      },
      {
        "db": "VULHUB",
        "id": "VHN-8727"
      },
      {
        "db": "BID",
        "id": "9682"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2004-000790"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200411-149"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0297"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#972334"
      },
      {
        "db": "VULHUB",
        "id": "VHN-8727"
      },
      {
        "db": "BID",
        "id": "9682"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2004-000790"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200411-149"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0297"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2004-02-23T00:00:00",
        "db": "CERT/CC",
        "id": "VU#972334"
      },
      {
        "date": "2004-11-23T00:00:00",
        "db": "VULHUB",
        "id": "VHN-8727"
      },
      {
        "date": "2004-02-17T00:00:00",
        "db": "BID",
        "id": "9682"
      },
      {
        "date": "2024-05-31T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2004-000790"
      },
      {
        "date": "2004-02-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200411-149"
      },
      {
        "date": "2004-11-23T05:00:00",
        "db": "NVD",
        "id": "CVE-2004-0297"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2004-03-19T00:00:00",
        "db": "CERT/CC",
        "id": "VU#972334"
      },
      {
        "date": "2017-10-10T00:00:00",
        "db": "VULHUB",
        "id": "VHN-8727"
      },
      {
        "date": "2004-02-17T00:00:00",
        "db": "BID",
        "id": "9682"
      },
      {
        "date": "2024-05-31T10:31:00",
        "db": "JVNDB",
        "id": "JVNDB-2004-000790"
      },
      {
        "date": "2005-05-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200411-149"
      },
      {
        "date": "2017-10-10T01:30:19.640000",
        "db": "NVD",
        "id": "CVE-2004-0297"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200411-149"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "IMail Server LDAP daemon buffer overflow",
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#972334"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "unknown",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200411-149"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.