CVE-2008-2499 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 77.5% (pctl 100)
Patch early
A public exploit exists.
Description
Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code via a crafted URL.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 77.47% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-119 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2008-05-29 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| ibm | lotus sametime |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | IBM Lotus Domino Sametime - 'STMux.exe' Remote Stack Buffer Overflow (Metasploit) | 2010-05-09 |
| exploit-db | IBM Lotus Sametime 8.0 - Multiplexer Buffer Overflow | 2008-05-21 |
References
- http://secunia.com/advisories/30309
- http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21303920
- http://www.securityfocus.com/bid/29328
- http://www.securitytracker.com/id?1020093
- http://www.vupen.com/english/advisories/2008/1595/references
- http://www.zerodayinitiative.com/advisories/ZDI-08-028/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42575
- http://secunia.com/advisories/30309
- http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21303920
- http://www.securityfocus.com/bid/29328
- http://www.securitytracker.com/id?1020093
- http://www.vupen.com/english/advisories/2008/1595/references
- http://www.zerodayinitiative.com/advisories/ZDI-08-028/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42575
→ the Explorer · watch your stack · NVD