PT-2005-5139 · Mailenable · Mailenable Professional+1

Tim Shelton · Publicado 2005-12-21 · Atualizado 2008-09-05 · CVE-2005-4456

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MailEnable Professional versions 1.71 and prior MailEnable Enterprise versions 1.1 and prior

Description The issue is related to multiple buffer overflows in MailEnable, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via long commands such as LIST, LSUB, and UID FETCH. These vulnerabilities can be exploited by an authenticated user to cause a DoS via malformed arguments or to cause a stack-based buffer overflow via an overly long argument.

Recommendations For MailEnable Professional versions 1.71 and prior, apply patch ME-10009 to resolve the issue. For MailEnable Enterprise versions 1.1 and prior, apply patch ME-10009 to resolve the issue. As a temporary workaround, consider restricting access to the IMAP service or disabling the UID FETCH, LIST, and LSUB commands until a patch is applied.

Exploit

Correção

Identificadores relacionados

CVE-2005-4456

Produtos afetados

Mailenable Enterprise

Mailenable Professional

Referências · 9

• 🔥 https://exploit-db.com/exploits/1378 · Exploit
• 🔥 http://securityfocus.com/bid/15985 · Exploit
• 🔥 http://seclists.org/lists/fulldisclosure/2005/Dec/1036.html · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-4457 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2005-4456 · Nota de Segurança
• http://secunia.com/advisories/18134 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-4456 · Nota de Segurança
• http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/040388.html · Nota
• http://securitylab.ru/vulnerability/243324.php · Nota