CVE-2006-0559

Format string vulnerability in the SMTP server for McAfee WebShield 4.5 MR2 and earlier allows remote attackers to execute arbitrary code via format strings in the domain name portion of a destination address, which are not properly handled when a bounce message is constructed.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.securityfocus.com/bid/16742	Patch
http://secunia.com/advisories/19491	Patch Vendor Advisory
http://securitytracker.com/id?1015861
http://www.osvdb.org/24366
http://securityreason.com/securityalert/671
http://www.vupen.com/english/advisories/2006/1219
https://exchange.xforce.ibmcloud.com/vulnerabilities/25621
http://www.securityfocus.com/archive/1/429812/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:mcafee:webshield_smtp:*:mr2_patch:*:*:*:*:*:*

Information

Published : 2006-04-04 07:04

Updated : 2018-10-19 08:45

NVD link : CVE-2006-0559

Mitre link : CVE-2006-0559

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

mcafee

webshield_smtp

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/16742", "name": "16742", "tags": ["Patch"], "refsource": "BID"}, {"url": "http://secunia.com/advisories/19491", "name": "19491", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://securitytracker.com/id?1015861", "name": "1015861", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.osvdb.org/24366", "name": "24366", "tags": [], "refsource": "OSVDB"}, {"url": "http://securityreason.com/securityalert/671", "name": "671", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2006/1219", "name": "ADV-2006-1219", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25621", "name": "webshield-smtp-format-string(25621)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/429812/100/0/threaded", "name": "20060404 SYMSA-2006-002: McAfee WebShield SMTP Format String Vulnerability", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Format string vulnerability in the SMTP server for McAfee WebShield 4.5 MR2 and earlier allows remote attackers to execute arbitrary code via format strings in the domain name portion of a destination address, which are not properly handled when a bounce message is constructed."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-0559", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": true, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2006-04-04T14:04Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:mcafee:webshield_smtp:*:mr2_patch:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "4.5"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-19T15:45Z"}