« Volver al listado

CVE-2008-7074

Estado: ModificadaAlta (9.3)—💥 Exploit

Vulnerabilidad de formato de cadena en MemeCode Software i.Scribe desde v1.88 hasta v2.00 anteriores a la Beta9 permite a servidores SMTP remotos producir una denegación de servicio (caída) y posiblemente ejecutar código arbitrario a través de los especificadores del formato de cadena en la respuesta del servidor, lo que no es correctamente manejado "cuando se muestra el mensaje signon".

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Memcode — I.scribe

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-7074",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-08-25T10:30:00.517",
  "references": [
    {
      "url": "http://memecode.com/site/ver.php?id=264",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/50232",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/32906",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/32497",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46970",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/7249",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://memecode.com/site/ver.php?id=264",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/50232",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/32906",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/32497",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46970",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/7249",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-134"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Format string vulnerability in MemeCode Software i.Scribe 1.88 through 2.00 before Beta9 allows remote SMTP servers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in a server response, which is not properly handled \"when displaying the signon message.\""
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de formato de cadena en MemeCode Software i.Scribe desde v1.88 hasta v2.00 anteriores a la Beta9 permite a servidores SMTP remotos producir una denegación de servicio (caída) y posiblemente ejecutar código arbitrario a través de los especificadores del formato de cadena en la respuesta del servidor, lo que no es correctamente manejado \"cuando se muestra el mensaje signon\"."
    }
  ],
  "lastModified": "2026-06-16T23:03:32.760",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:memcode:i.scribe:1.88:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B43F9986-6C5A-44C4-8B74-8973A221F466"
            },
            {
              "criteria": "cpe:2.3:a:memcode:i.scribe:1.89:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79726288-F9AD-4378-BBCC-FED62FFAD995"
            },
            {
              "criteria": "cpe:2.3:a:memcode:i.scribe:1.90:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E3C99347-3030-4CFA-8615-4410B16BFF28"
            },
            {
              "criteria": "cpe:2.3:a:memcode:i.scribe:2.00:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2102E98F-39AC-41A2-8F63-6E8F0AAD3729"
            },
            {
              "criteria": "cpe:2.3:a:memcode:i.scribe:2.00:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD0C7F29-D138-481F-BBB4-2AA18D87C90C"
            },
            {
              "criteria": "cpe:2.3:a:memcode:i.scribe:2.00:alpha3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B416E217-2274-41B0-9E2D-338462682A3F"
            },
            {
              "criteria": "cpe:2.3:a:memcode:i.scribe:2.00:alpha4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77867372-C31A-4C5E-B89C-C07A6806A9C1"
            },
            {
              "criteria": "cpe:2.3:a:memcode:i.scribe:2.00:beta10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A97611C-5C8B-43EF-A5F9-41196190E59A"
            },
            {
              "criteria": "cpe:2.3:a:memcode:i.scribe:2.00:beta11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DFD7A3FC-87EC-4D6D-B4D9-4E97E484AAED"
            },
            {
              "criteria": "cpe:2.3:a:memcode:i.scribe:2.00:beta6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E9F9068-242C-427A-B787-FCAEF427601E"
            },
            {
              "criteria": "cpe:2.3:a:memcode:i.scribe:2.00:beta7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E3A14D50-F2B1-43DC-9197-2BD7E4DA98E3"
            },
            {
              "criteria": "cpe:2.3:a:memcode:i.scribe:2.00:beta8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48E483AB-5EE1-40C4-BF6D-96C582427BEA"
            },
            {
              "criteria": "cpe:2.3:a:memcode:i.scribe:2.00:beta9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "084F9645-8819-4C1D-9403-5F8BEAE7F5FB"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}