{"id":"CVE-2008-2499","aliases":["EUVD-2008-2494","GHSA-9253-932v-rphr"],"status":"published","title":"Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM...","description":"Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code via a crafted URL.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.77466,"percentile":0.99563,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-119"],"published":"2008-05-29T16:00:00Z","modified":"2026-06-16T22:53:52Z","exploits":[{"source":"exploitdb","id":"EDB-16696","title":"IBM Lotus Domino Sametime - 'STMux.exe' Remote Stack Buffer Overflow (Metasploit)","type":"remote","platform":"windows","date":"2010-05-09","verified":true,"url":"https://www.exploit-db.com/exploits/16696"},{"source":"exploitdb","id":"EDB-31820","title":"IBM Lotus Sametime 8.0 - Multiplexer Buffer Overflow","type":"remote","platform":"unix","date":"2008-05-21","verified":true,"url":"https://www.exploit-db.com/exploits/31820"},{"source":"metasploit","id":"exploit/windows/lotus/domino_sametime_stmux","title":"IBM Lotus Domino Sametime STMux.exe Stack Buffer Overflow","type":"exploit","platform":"Windows","date":"2008-05-21","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/lotus/domino_sametime_stmux"}],"products":[{"vendor":"ibm","product":"lotus_sametime"}],"references":[{"url":"http://www.zerodayinitiative.com/advisories/ZDI-08-028/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1020093","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42575","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.vupen.com/english/advisories/2008/1595/references","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/29328","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://secunia.com/advisories/30309","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://www-1.ibm.com/support/docview.wss?rs=463\u0026uid=swg21303920","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-2499"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-08-028"},{"url":"https://github.com/advisories/GHSA-9253-932v-rphr"}],"sources":{"cve":[{"id":"CVE-2008-2499","description":"Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code via a crafted URL.","status":"published","published":"2008-05-29T16:00:00Z","modified":"2024-08-07T09:05:29.736Z","updated_at":"2026-11-02T14:34:44.675398Z"}],"euvd":[{"id":"EUVD-2008-2494","description":"Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code via a crafted URL.","status":"published","published":"2008-05-29T16:00:00Z","modified":"2024-08-07T09:05:29Z","updated_at":"2026-11-03T01:38:56.592424Z"}],"ghsa":[{"id":"GHSA-9253-932v-rphr","title":"Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM...","description":"Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code via a crafted URL.","status":"published","published":"2022-05-01T23:50:27Z","modified":"2025-04-09T03:56:04Z","cwes":["CWE-119"],"updated_at":"2026-11-02T15:00:57.534439Z"}],"nvd":[{"id":"CVE-2008-2499","description":"Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code via a crafted URL.","status":"published","published":"2008-05-29T16:32:00Z","modified":"2026-06-16T22:53:52.957Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:01:26.626719Z"}]}}