Unscored severity · published May 29, 2008
CVE-2008-2499
Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers…
–
CVSS
77.5%
EPSS
No
On KEV
Description
Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code via a crafted URL.
Exploitation
Is it being used?
Exploit prediction (EPSS)77.5% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LS
Lotus Sametime · Ibm
through 7.5; 8.0 before 8.0.1; 7.5.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-2499
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-2499
Third Party Advisory
http://secunia.com/advisories/30309
Vendor Advisory
http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21303920
Exploit
http://www.securityfocus.com/bid/29328
Third Party Advisory
http://www.securitytracker.com/id?1020093
Third Party Advisory
http://www.vupen.com/english/advisories/2008/1595/references
Third Party Advisory
http://www.zerodayinitiative.com/advisories/ZDI-08-028/
More from Lotus Sametime
–
CVE-2013-3985
The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 does not properly restrict application cookies, which allows remote attackers to read session variables by…
–
CVE-2013-3045
The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to share crafted links via the Library function
–
CVE-2013-3044
The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to spoof the origin of chat messages, or compose anonymous chat messages,…
–
CVE-2013-0537
The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to spoof the origin of shared links by leveraging meeting-attendance…
–
CVE-2013-3986
IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote attackers to cause a denial of service (WebPlayer Firefox extension crash) via a crafted Audio Visual (AV) session