PT-2007-3018 · Ipswitch · Ipswitch Imail Server

Publicado 2007-03-23 · Atualizado 2011-03-08 · CVE-2007-1637

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Ipswitch IMail Server versions prior to 2006.2

Description: The issue is related to multiple buffer overflows in the IMAILAPILib ActiveX control. This can be exploited by remote attackers to execute arbitrary code. The exploitation can occur through various members in different controls, including the WebConnect and Connect members in the IMailServer control, the Sync3 and Init3 members in the IMailLDAPService control, and the SetReplyTo member in the IMailUserCollection control.

Recommendations: For Ipswitch IMail Server versions prior to 2006.2, update to version 2006.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the IMailAPI.dll ActiveX control until a patch is applied. Avoid using the vulnerable members, such as WebConnect, Connect, Sync3, Init3, and SetReplyTo, in the affected controls until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-1637

Produtos afetados

Ipswitch Imail Server

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-1637 · Nota de Segurança
• http://secunia.com/advisories/24422 · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/0853 · Nota
• http://support.ipswitch.com/kb/IM-20070305-JH01.htm · Nota
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=487 · Nota
• http://securitytracker.com/id?1017737 · Nota