CVE-2007-5740 Code injection in n/a
Remote attackers can execute arbitrary code on Perdition Mail Retrieval Proxy by exploiting a format string vulnerability in IMAP tag handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-5740?
CVE-2007-5740 is a high-severity code injection vulnerability in n/a, published on 31 Oct 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The format string protection mechanism in IMAPD for Perdition Mail Retrieval Proxy 1.17 and earlier allows remote attackers to execute arbitrary code via an IMAP tag with a null byte followed by a format string specifier, which is not counted by the mechanism.
Weakness: CWE-134
Which versions are affected by CVE-2007-5740?
It affects 1 product.
Products include Vergenet Perdition Mail Retrieval Proxy.
How do I fix CVE-2007-5740?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2007-5740 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-5740 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as DEBIAN-CVE-2007-5740, DSA-1398-1, DTSA-84-1, GHSA-h8w3-m7vj-q5mc.