CVE-2008-0945

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-02-25 · updated 2026-06-16
Weakness: CWE-134

Description

Format string vulnerability in the logging function in the IM Server (aka IMserve or IMserver) in Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in an IP address field.

Affected products

Ipswitch Imserver: through 2.0.8.1
Ipswitch Instant Messaging: through 2.0.8.1

References

http://aluigi.altervista.org/adv/ipsimene-adv.txt
http://aluigi.org/poc/ipsimene.zip
http://secunia.com/advisories/28824
http://securityreason.com/securityalert/3697
http://www.securityfocus.com/archive/1/487748/100/200/threaded
http://www.securityfocus.com/bid/27677
http://aluigi.altervista.org/adv/ipsimene-adv.txt
http://aluigi.org/poc/ipsimene.zip
http://secunia.com/advisories/28824
http://securityreason.com/securityalert/3697
http://www.securityfocus.com/archive/1/487748/100/200/threaded
http://www.securityfocus.com/bid/27677

Get alerted when CVE-2008-0945 or the next vulnerability affects your stack