PT-2005-1134 · Gfi+1 · Gfi Mailsecurity For Exchange+4

Publicado 2005-01-03 · Atualizado 2008-09-05 · CVE-2004-1312

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft HTML library (affected versions not specified) GFI MailEssentials for Exchange versions 9 and 10 GFI MailSecurity for Exchange version 8

Description A bug in the HTML parser of a Microsoft HTML library may allow remote attackers to cause a denial of service via certain strings. This issue has been reported in GFI MailEssentials for Exchange 9 and 10, and GFI MailSecurity for Exchange 8, resulting in emails remaining in IIS or Exchange mail queues.

Recommendations For GFI MailEssentials for Exchange versions 9 and 10, consider implementing input validation to prevent malicious strings from being processed. For GFI MailSecurity for Exchange version 8, restrict the processing of emails that contain potentially malicious HTML content. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2004-1312

Produtos afetados

Exchange Server

Gfi Mailessentials For Exchange

Gfi Mailsecurity For Exchange

Iis

Html Library

Referências · 5

• http://kbase.gfi.com/showarticle.asp?id=KBID002249 · Aviso do Fabricante
• http://securityfocus.com/bid/12148 · Nota
• http://csis.dk/default.asp?m=1&a=194 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-1312 · Nota de Segurança
• http://secunia.com/advisories/13708 · Nota