Read the docs
TI-2008-03453 Aliases CVE-2008-3606GHSA-4pp7-p29p-wcpw

Heap-based buffer overflow in the IMAP service in Qbik WinGate 6.2.2.1137 and earlier…

Priority LOW 36CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Heap-based buffer overflow in the IMAP service in Qbik WinGate 6.2.2.1137 and earlier allows remote authenticated users to cause a denial of service (resource exhaustion) or possibly execute arbitrary code via a long argument to the LIST command. NOTE: some of these details are obtained from third party information.

Why it matters now

EPSS 0.04452 91st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 44

CPEVersionsRoleVendor
cpe:2.3:a:qbik:wingate:*:*:*:*:*:*:*:*up to 6.2.2VulnerableQbik
cpe:2.3:a:qbik:wingate:2.0:*:*:*:*:*:*:*2.0VulnerableQbik
cpe:2.3:a:qbik:wingate:2.1:*:*:*:*:*:*:*2.1VulnerableQbik
cpe:2.3:a:qbik:wingate:3.0:*:*:*:*:*:*:*3.0VulnerableQbik
cpe:2.3:a:qbik:wingate:3.0.5:*:*:*:*:*:*:*3.0.5VulnerableQbik
cpe:2.3:a:qbik:wingate:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableQbik
cpe:2.3:a:qbik:wingate:4.1:beta_a:*:*:*:*:*:*4.1 beta_aVulnerableQbik
cpe:2.3:a:qbik:wingate:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableQbik
cpe:2.3:a:qbik:wingate:4.1.1:*:*:*:*:*:*:*4.1.1VulnerableQbik
cpe:2.3:a:qbik:wingate:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableQbik
  • cpe:2.3:a:qbik:wingate:*:*:*:*:*:*:*:* Versions up to 6.2.2 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:4.1:beta_a:*:*:*:*:*:* Versions 4.1 beta_a Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Qbik
Show 34 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:qbik:wingate:4.3.0:*:*:*:*:*:*:*4.3.0VulnerableQbik
cpe:2.3:a:qbik:wingate:4.3.0:beta_a:*:*:*:*:*:*4.3.0 beta_aVulnerableQbik
cpe:2.3:a:qbik:wingate:4.3.0:beta_b:*:*:*:*:*:*4.3.0 beta_bVulnerableQbik
cpe:2.3:a:qbik:wingate:4.4.0:*:*:*:*:*:*:*4.4.0VulnerableQbik
cpe:2.3:a:qbik:wingate:4.4.0:beta_a:*:*:*:*:*:*4.4.0 beta_aVulnerableQbik
cpe:2.3:a:qbik:wingate:4.4.1:*:*:*:*:*:*:*4.4.1VulnerableQbik
cpe:2.3:a:qbik:wingate:4.4.2:*:*:*:*:*:*:*4.4.2VulnerableQbik
cpe:2.3:a:qbik:wingate:4.5.0:beta_a:*:*:*:*:*:*4.5.0 beta_aVulnerableQbik
cpe:2.3:a:qbik:wingate:4.5.0:beta_b:*:*:*:*:*:*4.5.0 beta_bVulnerableQbik
cpe:2.3:a:qbik:wingate:4.5.1:*:*:*:*:*:*:*4.5.1VulnerableQbik
cpe:2.3:a:qbik:wingate:4.5.2:*:*:*:*:*:*:*4.5.2VulnerableQbik
cpe:2.3:a:qbik:wingate:5.0:*:*:*:*:*:*:*5.0VulnerableQbik
cpe:2.3:a:qbik:wingate:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableQbik
cpe:2.3:a:qbik:wingate:5.0.1:*:*:*:*:*:*:*5.0.1VulnerableQbik
cpe:2.3:a:qbik:wingate:5.0.1.766:*:*:*:*:*:*:*5.0.1.766VulnerableQbik
cpe:2.3:a:qbik:wingate:5.0.5:*:*:*:*:*:*:*5.0.5VulnerableQbik
cpe:2.3:a:qbik:wingate:5.1:*:*:*:*:*:*:*5.1VulnerableQbik
cpe:2.3:a:qbik:wingate:5.2:*:*:*:*:*:*:*5.2VulnerableQbik
cpe:2.3:a:qbik:wingate:5.2.2:*:*:*:*:*:*:*5.2.2VulnerableQbik
cpe:2.3:a:qbik:wingate:5.2.3:*:*:*:*:*:*:*5.2.3VulnerableQbik
cpe:2.3:a:qbik:wingate:6.0:*:*:*:*:*:*:*6.0VulnerableQbik
cpe:2.3:a:qbik:wingate:6.0.0.984:*:*:*:*:*:*:*6.0.0.984VulnerableQbik
cpe:2.3:a:qbik:wingate:6.0.1.993:*:*:*:*:*:*:*6.0.1.993VulnerableQbik
cpe:2.3:a:qbik:wingate:6.0.1.995:*:*:*:*:*:*:*6.0.1.995VulnerableQbik
cpe:2.3:a:qbik:wingate:6.0.2.1000:*:*:*:*:*:*:*6.0.2.1000VulnerableQbik
cpe:2.3:a:qbik:wingate:6.0.2.1001:*:*:*:*:*:*:*6.0.2.1001VulnerableQbik
cpe:2.3:a:qbik:wingate:6.0.3.1005:*:*:*:*:*:*:*6.0.3.1005VulnerableQbik
cpe:2.3:a:qbik:wingate:6.0.4.1025:*:*:*:*:*:*:*6.0.4.1025VulnerableQbik
cpe:2.3:a:qbik:wingate:6.1.1.1077:*:*:*:*:*:*:*6.1.1.1077VulnerableQbik
cpe:2.3:a:qbik:wingate:6.1.2.1094:*:*:*:*:*:*:*6.1.2.1094VulnerableQbik
cpe:2.3:a:qbik:wingate:6.1.3.1096:*:*:*:*:*:*:*6.1.3.1096VulnerableQbik
cpe:2.3:a:qbik:wingate:6.1.4:*:*:*:*:*:*:*6.1.4VulnerableQbik
cpe:2.3:a:qbik:wingate:6.2.1:*:*:*:*:*:*:*6.2.1VulnerableQbik
cpe:2.3:a:qbik:wingate:6.2.2.1137:*:*:*:*:*:*:*6.2.2.1137VulnerableQbik
  • cpe:2.3:a:qbik:wingate:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:4.3.0:beta_a:*:*:*:*:*:* Versions 4.3.0 beta_a Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:4.3.0:beta_b:*:*:*:*:*:* Versions 4.3.0 beta_b Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:4.4.0:*:*:*:*:*:*:* Versions 4.4.0 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:4.4.0:beta_a:*:*:*:*:*:* Versions 4.4.0 beta_a Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:4.4.1:*:*:*:*:*:*:* Versions 4.4.1 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:4.4.2:*:*:*:*:*:*:* Versions 4.4.2 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:4.5.0:beta_a:*:*:*:*:*:* Versions 4.5.0 beta_a Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:4.5.0:beta_b:*:*:*:*:*:* Versions 4.5.0 beta_b Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:4.5.1:*:*:*:*:*:*:* Versions 4.5.1 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:4.5.2:*:*:*:*:*:*:* Versions 4.5.2 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:5.0.1.766:*:*:*:*:*:*:* Versions 5.0.1.766 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:5.0.5:*:*:*:*:*:*:* Versions 5.0.5 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:5.1:*:*:*:*:*:*:* Versions 5.1 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:5.2:*:*:*:*:*:*:* Versions 5.2 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:5.2.2:*:*:*:*:*:*:* Versions 5.2.2 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:5.2.3:*:*:*:*:*:*:* Versions 5.2.3 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.0.0.984:*:*:*:*:*:*:* Versions 6.0.0.984 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.0.1.993:*:*:*:*:*:*:* Versions 6.0.1.993 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.0.1.995:*:*:*:*:*:*:* Versions 6.0.1.995 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.0.2.1000:*:*:*:*:*:*:* Versions 6.0.2.1000 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.0.2.1001:*:*:*:*:*:*:* Versions 6.0.2.1001 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.0.3.1005:*:*:*:*:*:*:* Versions 6.0.3.1005 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.0.4.1025:*:*:*:*:*:*:* Versions 6.0.4.1025 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.1.1.1077:*:*:*:*:*:*:* Versions 6.1.1.1077 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.1.2.1094:*:*:*:*:*:*:* Versions 6.1.2.1094 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.1.3.1096:*:*:*:*:*:*:* Versions 6.1.3.1096 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.1.4:*:*:*:*:*:*:* Versions 6.1.4 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.2.1:*:*:*:*:*:*:* Versions 6.2.1 Vulnerable ·Qbik
  • cpe:2.3:a:qbik:wingate:6.2.2.1137:*:*:*:*:*:*:* Versions 6.2.2.1137 Vulnerable ·Qbik

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-3606
  2. 2026-10-03 Alias added: GHSA-4pp7-p29p-wcpw

References

Advisory 1

  • TI-2006-02833 Stack-based buffer overflow in the WWW Proxy Server of Qbik WinGate 6.1.1.1077 allows… CVSS 2.0HIGH 7.5
  • TI-1999-00287 The WinGate proxy is installed without a password, which allows remote attackers to… CVSS 2.0HIGH 7.5
  • TI-2020-10850 WinGate v9.4.1.5998 has insecure permissions for the installation directory, which allows… CVSS 3.1HIGH 7.8
  • TI-1999-00436 Remote attackers can perform a denial of service in WinGate machines using a buffer… CVSS 2.0MEDIUM 5.0
  • TI-2009-00762 Qbik WinGate, when transparent interception mode is enabled, uses the HTTP Host header to… CVSS 2.0MEDIUM 5.4
  • TI-2006-02824 Directory traversal vulnerability in the IMAP server in WinGate 6.1.2.1094 and… CVSS 2.0MEDIUM 5.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences