A vulnerability was found in Sybase vpopmail up to 5.4.2 and classified as critical. Affected by this issue is the function sprint of the file vsybase.c. The manipulation with an unknown input leads to a format string vulnerability. Using CWE to declare the problem leads to CWE-134. The product uses a function that accepts a format string as an argument, but the format string originates from an external source. Impacted is integrity. CVE summarizes:

** DISPUTED ** Format string vulnerability in vsybase.c in vpopmail 5.4.2 and earlier has unknown impact and attack vectors. NOTE: in a followup post, it was observed that the source code used constants that, when compiled, became static format strings. Thus this is not a vulnerability.

The weakness was shared 08/12/2004 by Jérôme (Website). The advisory is shared for download at archives.neohapsis.com. This vulnerability is handled as CVE-2004-2238 since 07/17/2005. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (17017), SecurityFocus (BID 10962†) and OSVDB (9147†). The entry VDB-23145 is related to this item.

Productinfo

Vendor

• Sybase

Name

• vpopmail

Version

• 5.4.0
• 5.4.1
• 5.4.2

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion