CVE-2004-2677

Format string vulnerability in qwik-smtpd.c in QwikMail SMTP (qwik-smtpd) 0.3 and earlier allows remote attackers to execute arbitrary code via format specifiers in the (1) clientRcptTo array, and the (2) Received and (3) messageID variables, possibly involving HELO and hostname arguments.

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

6.48% chance of exploitation in the next 30 days, 94th percentile

Published

2007-02-22

Updated

2024-08-08

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/620

Security advisories

• http://secunia.com/advisories/13037
• http://securitytracker.com/id?1012016
• http://www.securityfocus.com/bid/11572
• http://qwikmail.sourceforge.net/smtpd/qwik-smtpd-0.3.patch

References

• CVE Record
• NVD entry