PT-2008-2868 · Mailenable · Mailenable Enterprise Edition+1

Luigi Auriemma · Publicado 2008-03-10 · Atualizado 2018-10-11 · CVE-2008-1276

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MailEnable Professional Edition versions 3.13 and earlier MailEnable Enterprise Edition versions 3.13 and earlier

Description The issue is related to multiple buffer overflows in the IMAP service, which can be exploited by remote authenticated attackers to execute arbitrary code. This can be achieved by providing long arguments to specific commands, including the FETCH, EXAMINE, and UNSUBSCRIBE commands.

Recommendations For MailEnable Professional Edition versions 3.13 and earlier, update to a version later than 3.13 to resolve the issue. For MailEnable Enterprise Edition versions 3.13 and earlier, update to a version later than 3.13 to resolve the issue. As a temporary workaround, consider restricting access to the IMAP service or limiting the length of arguments to the FETCH, EXAMINE, and UNSUBSCRIBE commands until a patch is available.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2008-1276

Produtos afetados

Mailenable Enterprise Edition

Mailenable Professional Edition

Referências · 11

• 🔥 https://exploit-db.com/exploits/5249 · Exploit
• 🔥 http://securityfocus.com/bid/28145 · Exploit
• http://vupen.com/english/advisories/2008/0799/references · Nota
• http://securityfocus.com/archive/1/489270/100/0/threaded · Nota
• http://aluigi.altervista.org/adv/maildisable-adv.txt · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41058 · Nota
• http://securitytracker.com/id?1019565 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1276 · Nota de Segurança
• http://secunia.com/advisories/29277 · Aviso do Fabricante
• http://xforce.iss.net/xforce/xfdb/41058 · Nota
• http://securityreason.com/securityalert/3724 · Nota