Description
Stack-based buffer overflow in expires.c in Elm 2.5 PL5 through PL7, and possibly other versions, allows remote attackers to execute arbitrary code via an e-mail message with a long Expires header.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Elm < 2.5.8 - Expires Header Remote Buffer Overflow EDB-1171 · remote · Aug 22, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- SSA:2005-311 vendor-advisory
- 16508 third-party-advisory
- 1014745 vdb-entry
- RHSA-2005:755 vendor-advisory
- GLSA-200510-15 vendor-advisory
- 20050822 ELM < 2.5.8 Remote Exploit POC mailing-list
- 20050820 [RETRO AUDITING] Elm remote buffer overflow in Expires header mailing-list
- MDKSA-2005:186 vendor-advisory
- SA-2005.47 vendor-advisory
- 15117 vdb-entry
- 17475 third-party-advisory
- 16554 third-party-advisory
- 14613 vdb-entry
- SSA:2005-310-03 vendor-advisory