PT-2010-4125 · Mailenable · Mailenable

Soroush Dalili · Publicado 2010-09-15 · Atualizado 2018-10-10 · CVE-2010-2580

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions MailEnable versions 3.x through 4.25

Description The issue concerns the SMTP service in MailEnable, where it fails to properly check the length of certain parameters. This can be exploited by remote attackers to cause a denial of service, leading to a crash. The attack can be initiated by sending a long email address in the MAIL FROM command or a long domain name in the RCPT TO command. This triggers an unhandled invalid parameter error.

Recommendations For MailEnable versions 3.x through 4.25, consider restricting access to the SMTP service until a fix is available. As a temporary workaround, limit the length of email addresses and domain names that can be processed by the MAIL FROM and RCPT TO commands to prevent the denial of service.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2010-2580

Produtos afetados

Mailenable

Referências · 11

• http://mailenable.com/hotfix · Aviso do Fabricante
• http://secunia.com/advisories/41175 · Aviso do Fabricante
• http://securityfocus.com/archive/1/513648/100/0/threaded · Nota
• http://secunia.com/secunia_research/2010-112 · Aviso do Fabricante
• http://mailenable.com/Professional-ReleaseNotes.txt · Nota
• http://securityfocus.com/bid/43182 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2580 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2580 · Nota
• http://mailenable.com/Enterprise-ReleaseNotes.txt · Nota
• http://mailenable.com/Standard-ReleaseNotes.txt · Nota
• http://securitytracker.com/id?1024427 · Nota