CVE-2018-25223 - Vulnerability Analysis

Overview

Crashmail 1.6 contains a buffer overflow caused by improper input handling, letting remote attackers execute arbitrary code, exploit requires sending crafted malicious input.

Severity & Score

Impact

Remote attackers can execute arbitrary code or cause denial of service, potentially compromising the application.

Mitigation

Update to the latest version of Crashmail.

References

• https://www.exploit-db.com/exploits/44331
• https://www.vulncheck.com/advisories/crashmail-stack-based-buffer-overflow-remote-code-execution
• http://exploitpack.com
• http://ftnapps.sourceforge.net/crashmail.html

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner