CVE-2009-0410

critical

Description

Off-by-one error in the SMTP daemon in GroupWise Internet Agent (GWIA) in Novell GroupWise 6.5x, 7.0, 7.01, 7.02, 7.03, 7.03HP1a, and 8.0 allows remote attackers to execute arbitrary code via a long e-mail address in a malformed RCPT command, leading to a buffer overflow.

References

https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-0414

http://www.zerodayinitiative.com/advisories/ZDI-09-010/

http://www.securityfocus.com/bid/33560

http://www.securityfocus.com/archive/1/500609/100/0/threaded

http://www.novell.com/support/viewContent.do?externalId=7002502

http://secunia.com/advisories/33744

http://download.novell.com/Download?buildid=GjZRRdqCFW0

Details

Source: Mitre, NVD

Published: 2009-02-03

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.19165