← Vulnerability feed

Vulnerability record · CVE-2008-1337 · published 14 March 2008

CVE-2008-1337: Netopia timbuktu pro improper input validation vulnerability

Netopia · Timbuktu Pro

The instant message service in Timbuktu Pro 8.6.5 RC 229 and earlier for Windows allows remote attackers to cause (1) a denial of service (daemon crash) via an invalid Version field or (2) a denial of service (CPU consumption and daemon termination) via an invalid or partial message.

5.0 CVSS 2.0 Medium EPSS 1.7% · top 23.5% CWE-20 · Improper input validation
5.0CVSS 2.0 base score
1.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

The instant message service in Timbuktu Pro 8.6.5 RC 229 and earlier for Windows allows remote attackers to cause (1) a denial of service (daemon crash) via an invalid Version field or (2) a denial of service (CPU consumption and daemon termination) via an invalid or partial message.

AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://aluigi.altervista.org/adv/timbuto-adv.txt
http://aluigi.org/poc/timbuto.zip Exploit
http://secunia.com/advisories/29316 Vendor Advisory
http://securityreason.com/securityalert/3741
http://www.securityfocus.com/archive/1/489360/100/0/threaded
http://www.vupen.com/english/advisories/2008/0840
http://aluigi.altervista.org/adv/timbuto-adv.txt
http://aluigi.org/poc/timbuto.zip Exploit
http://secunia.com/advisories/29316 Vendor Advisory
http://securityreason.com/securityalert/3741
http://www.securityfocus.com/archive/1/489360/100/0/threaded
http://www.vupen.com/english/advisories/2008/0840

Track CVE-2008-1337 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-1117Timbuktu Pro Notes directory traversal allows arbitrary file uploadThe Notes (instant message) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows (and possibly 8.7 for Mac OS X) fails to properly sanitize destin…EPSS 69%analysed7.5CVE-2008-1118Netopia timbuktu pro improper input validation vulnerabilityTimbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, does not perform input validation before logging information fields taken from packets…EPSS 2.9%5.0CVE-2002-0135Netopia timbuktu pro vulnerabilityNetopia Timbuktu Pro 6.0.1 and earlier allows remote attackers to cause a denial of service (crash) via a series of connections to one of the ports (…EPSS 3.2%5.0CVE-2000-0142Netopia timbuktu pro vulnerabilityThe authentication protocol in Timbuktu Pro 2.0b650 allows remote attackers to cause a denial of service via connections to port 407 and 1417.EPSS 8.0%5.0CVE-2000-0086Netopia timbuktu pro vulnerabilityNetopia Timbuktu Pro sends user IDs and passwords in cleartext, which allows remote attackers to obtain them via sniffing.EPSS 1.4%9.5CVE-2026-88771Citrix NetScaler Improper Input Validation VulnerabilityImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-…KEV9.5CVE-2026-93952Arista velocloud orchestrator improper input validation vulnerabilityVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality an…KEVEPSS 0.90%8.8CVE-2019-1068Microsoft SQL Server improper input validation remote code executionMicrosoft SQL Server mishandles processing of internal functions, allowing an authenticated remote attacker to execute code on the database server. T…KEVEPSS 58%analysed

Source: NIST National Vulnerability Database (record CVE-2008-1337), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.