Vulnerability record · CVE-2008-1914 · published 22 April 2008
CVE-2008-1914: BigAnt IM Server AntServer stack buffer overflow via long URI
Bigantsoft · Bigant Messenger
BigAnt Messenger 2.2's AntServer module (AntServer.exe) contains a stack-based buffer overflow reachable through a long URI sent to TCP port 6080. A remote, unauthenticated attacker can trigger it, and the record notes some details come from third-party information.
Description
Stack-based buffer overflow in the AntServer module (AntServer.exe) in BigAnt IM Server in BigAnt Messenger 2.2 allows remote attackers to execute arbitrary code via a long URI in a request to TCP port 6080. NOTE: some of these details are obtained from third party information.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
high priorityUnauthenticated remote code execution with a 10.0 CVSS score and very high EPSS, though the product is old and no KEV listing exists.
What it is
BigAnt Messenger 2.2's AntServer module (AntServer.exe) contains a stack-based buffer overflow reachable through a long URI sent to TCP port 6080. A remote, unauthenticated attacker can trigger it, and the record notes some details come from third-party information.
Impact
Successful exploitation allows remote code execution with full confidentiality, integrity and availability impact under the CVSS 2.0 vector. An attacker gains control of the AntServer process on the exposed host.
Attack surface
Reached over the network via a crafted request to TCP port 6080; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.737 probability, 99.45th percentile) and a public Exploit-DB entry (5451) exists, indicating mature public exploit code.
What to do
- Apply the vendor fix referenced in the Secunia advisory (29831) or upgrade BigAnt Messenger beyond 2.2; no patched version is stated in this record.
- If no patch is available, block or restrict TCP port 6080 to trusted hosts only.
- Isolate the IM server from untrusted networks and place it behind a firewall or VPN.
- Retire or replace the product if the vendor no longer supports it, since the record gives no supported-version guidance.
Detection
- Monitor network traffic and logs for oversized or malformed URI requests to TCP port 6080.
- Watch for AntServer.exe crashes or abnormal process termination on the IM server host.
- Alert on unexpected child processes or outbound connections spawned by AntServer.exe.
- Review firewall and IDS logs for scanning or repeated connections to port 6080 from external addresses.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2008-1914 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2008-1914), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
