Stack-based buffer overflow in results.stm for Sambar Server before the 6.0 production release allows remote attackers to cause a denial of…

published 2004-02-06 22 y ago modified 2026-06-16 4 mo ago also EUVD-2004-2078

cvss: 5.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 75.5%; EPSS 75.5% chance of exploitation in 30 days, percentile 99.5%
public exploits: 3; Metasploit, Exploit-DB

Stack-based buffer overflow in results.stm for Sambar Server before the 6.0 production release allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP POST request with a long query parameter.

Patch / fix

links 2

sambar.com/security.htm advisory
osvdb.org/5786 advisory

Timeline

2003-06-21 First public exploit (Metasploit exploit/windows/http/sambar6_search_results)
2004-02-06 Published

Exploit prediction

75.48% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/windows/http/sambar6_search_results Sambar 6 Search Results Buffer Overflow metasploit exploit, normal rank, 2003-06-21
EDB-23664 Sambar Server 6.0 - 'results.stm' POST Buffer Overflow dos, 2004-02-09
EDB-16756 Sambar Server 6 - Search Results Buffer Overflow (Metasploit) remote, 2010-02-13
securitytracker.com http://securitytracker.com/id?1008979 referenced PoC, tagged "exploit" by a source, unverified
securityfocus.com http://www.securityfocus.com/bid/9607 referenced PoC, tagged "exploit" by a source, unverified
securityfocus.com http://www.securityfocus.com/archive/82/353087 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P

References

sambar.com /security.htm
patch, vendor-advisory
osvdb.org /5786
vdb-entry, patch, vendor-advisory
securitytracker.com /id?1008979
vdb-entry, exploit, vendor-advisory
securityfocus.com /bid/9607
vdb-entry, exploit, vendor-advisory
securityfocus.com /archive/82/353087
mailing-list, exploit, vendor-advisory
exchange.xforce.ibmcloud.com /vulnerabilities/15071
vdb-entry

Sources

CVE List CVE-2004-2086
NVD CVE-2004-2086

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary