CVE-2008-2499
published 2008-05-29CVE-2008-2499: Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1…
PriorityP264high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
77.47%
99.5th percentile
Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code via a crafted URL.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | lotus_sametime | <= 7.5 | — |
| ibm | lotus_sametime | — | — |
| ibm | lotus_sametime | >= 8.0 < 8.0.1 | 8.0.1 |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x74\x23\x75\x21
bytes↗
\xff\x24\x24
- →Detect exploit attempts by monitoring for HTTP POST requests to the path pattern /CommunityCBR/CC.39.* on TCP port 1533 with the User-Agent 'Sametime Community Agent'. ↗
- →The exploit overwrites the SEH chain; look for the ROP gadget return address 0x7c3410c2 (pop ecx/pop ecx/ret from msvcr71.dll) appearing in network traffic on port 1533. ↗
- →The exploit payload contains the JE/JNZ short-jump byte sequence 0x74 0x23 0x75 0x21 embedded in the URL path; this can be used as a network signature. ↗
- →Monitor STMux.exe (the Sametime Community Services Multiplexer) for abnormal process behaviour or crashes, as it is the vulnerable component listening on TCP 1533. ↗
- →A successful exploit may result in a bind shell on TCP port 4444 on the victim host; monitor for unexpected listening services on that port after STMux.exe activity. ↗
- ·Bad characters for the payload are \x00, \x0a, and \x0d — these bytes cannot appear in the exploit path or shellcode, which constrains shellcode selection. ↗
- ·The EXITFUNC is set to 'seh', meaning the shellcode exits via the SEH chain rather than process or thread exit; this affects post-exploitation stability. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
IBM Lotus Domino Sametime - 'STMux.exe' Remote Stack Buffer Overflow (Metasploit)
exploitdb·2010-05-09
CVE-2008-2499 IBM Lotus Domino Sametime - 'STMux.exe' Remote Stack Buffer Overflow (Metasploit)
IBM Lotus Domino Sametime - 'STMux.exe' Remote Stack Buffer Overflow (Metasploit)
---
##
# $Id: domino_sametime_stmux.rb 9262 2010-05-09 17:45:00Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'IBM Lotus Domino Sametime STMux.exe Stack Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in Lotus Domino\'s Sametime
Server. By sending an overly long POST request to the Multiplexer
STMux.exe service we are able to overwrite SEH. Based on the exploit
by Manuel Santamarina Suarez.
},
'Author' => [ 'patri
Exploit-DB
IBM Lotus Sametime 8.0 - Multiplexer Buffer Overflow
exploitdb·2008-05-21
CVE-2008-2499 IBM Lotus Sametime 8.0 - Multiplexer Buffer Overflow
IBM Lotus Sametime 8.0 - Multiplexer Buffer Overflow
---
source: https://www.securityfocus.com/bid/29328/info
IBM Lotus Sametime is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.
An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will likely result in a denial of service.
#!perl
#
# "IBM Lotus Sametime" StMUX Stack Overflow Exploit
#
# Author: Manuel Santamarina Suarez
# e-Mail: [email protected]
#
use IO::Socket;
use File::Basename;
#
# destination TCP port
#
$port = 1533;
#
# SE handler
#
# Don't use upper-case ASCII characters or 0x00, 0x0a, 0x0b, 0x0d, 0x20
# You MUST use a POP
Metasploit
IBM Lotus Domino Sametime STMux.exe Stack Buffer Overflow
metasploit
IBM Lotus Domino Sametime STMux.exe Stack Buffer Overflow
IBM Lotus Domino Sametime STMux.exe Stack Buffer Overflow
This module exploits a stack buffer overflow in Lotus Domino\'s Sametime Server. By sending an overly long POST request to the Multiplexer STMux.exe service we are able to overwrite SEH. Based on the exploit by Manuel Santamarina Suarez.
Nuclei
Graphite <=1.1.5 - Server-Side Request Forgery
nuclei·CVSS 7.5
CVE-2017-18638 [HIGH] Graphite <=1.1.5 - Server-Side Request Forgery
Graphite =1.1.6) or apply the necessary security patches.
reference:
- http://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html
- https://github.com/graphite-project/graphite-web/issues/2008
- https://github.com/advisories/GHSA-vfj6-275q-4pvm
- https://nvd.nist.gov/vuln/detail/CVE-2017-18638
- https://github.com/graphite-project/graphite-web/pull/2499
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2017-18638
cwe-id: CWE-918
epss-score: 0.87481
epss-percentile: 0.99458
cpe: cpe:2.3:a:graphite_project:graphite:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: graphite_project
product: graphite
tags: cve,cve2017,graphite,ssrf,oast,graphite_project,vuln
http:
- method: GET
path:
- '{{BaseURL}}/composer/send_email?to={{rand_te
No writeups or analysis indexed.
http://secunia.com/advisories/30309http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21303920http://www.securityfocus.com/bid/29328http://www.securitytracker.com/id?1020093http://www.vupen.com/english/advisories/2008/1595/referenceshttp://www.zerodayinitiative.com/advisories/ZDI-08-028/https://exchange.xforce.ibmcloud.com/vulnerabilities/42575http://secunia.com/advisories/30309http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21303920http://www.securityfocus.com/bid/29328http://www.securitytracker.com/id?1020093http://www.vupen.com/english/advisories/2008/1595/referenceshttp://www.zerodayinitiative.com/advisories/ZDI-08-028/https://exchange.xforce.ibmcloud.com/vulnerabilities/42575
2008-05-29
Published