CVE-2006-0559

Format string vulnerability in the SMTP server for McAfee WebShield 4.5 MR2 and earlier allows remote attackers to execute arbitrary code via format strings in the domain name portion of a destination address, which are not properly handled when a bounce message is constructed.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://secunia.com/advisories/19491	Patch Vendor Advisory
http://securityreason.com/securityalert/671
http://securitytracker.com/id?1015861
http://www.osvdb.org/24366
http://www.securityfocus.com/archive/1/429812/100/0/threaded
http://www.securityfocus.com/bid/16742	Patch
http://www.vupen.com/english/advisories/2006/1219
https://exchange.xforce.ibmcloud.com/vulnerabilities/25621

Configurations

Configuration 1 (hide)

cpe:2.3:a:mcafee:webshield_smtp:*:mr2_patch:*:*:*:*:*:*

History

No history.

Information

Published : 2006-04-04 14:04

Updated : 2018-10-19 15:45

NVD link : CVE-2006-0559

Mitre link : CVE-2006-0559

CVE.ORG link : CVE-2006-0559

JSON object : View

Products Affected

mcafee

webshield_smtp

CWE

NVD-CWE-Other

{"id": "CVE-2006-0559", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-04-04T14:04:00.000", "references": [{"url": "http://secunia.com/advisories/19491", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/671", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1015861", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/24366", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/429812/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/16742", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/1219", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25621", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Format string vulnerability in the SMTP server for McAfee WebShield 4.5 MR2 and earlier allows remote attackers to execute arbitrary code via format strings in the domain name portion of a destination address, which are not properly handled when a bounce message is constructed."}], "lastModified": "2018-10-19T15:45:19.817", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mcafee:webshield_smtp:*:mr2_patch:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0B91756-AD17-4D68-BE4C-E169BE6FEE9D", "versionEndIncluding": "4.5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org", "evaluatorSolution": "The vendor has released a patch (P0803), along with version 4.5 MR2 to address this issue."}