Perdition 1.17 IMAPD __STR_VWRITE Remote Format String Vulnerability

ID SSV:84091
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00


No description provided by source.


Perdition IMAP proxy server is prone to a remote format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

An attacker can exploit this issue to execute arbitrary machine code in the context of the affected application. A successful attack will compromise the application. Failed attempts may cause denial-of-service conditions.

This issue affects Perdition 1.17 and prior versions. 

The following proof of concept is available:

perl -e 'print "abc%n\x00\n"' | nc 143