Reed Arvin

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows 2000 SP4 **Description** The issue is related to an untrusted search path vulnerability in Winlogon, which can be exploited when SafeDllSearchMode is disabled. This allows local users to gain privileges via a malicious DLL in the UserProfile directory. The vulnerability could enable a logged-on user to take complete control of the system. **Recommendations** For Microsoft Windows 2000 SP4, enable SafeDllSearchMode to prevent the exploitation of this issue. As a temporary workaround, consider restricting access to the UserProfile directory to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** McAfee VirusScan Enterprise version 8.0i (patch 11) CMA version 3.5 (patch 5) **Description** The issue allows local users to potentially gain privileges through a malicious file. This occurs when naPrdMgr.exe attempts to execute EntVUtil.EXE under an unquoted "Program Files" path, and a malicious "program.exe" file is placed in the C: folder. **Recommendations** For McAfee VirusScan Enterprise version 8.0i (patch 11), consider updating to a newer version that quotes the Windows search path to prevent malicious file execution. For CMA version 3.5 (patch 5), consider updating to a newer version that quotes the Windows search path to prevent malicious file execution. As a temporary workaround, consider restricting write access to the C: folder to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** BusinessMail version 4.60.00 **Description** The issue concerns multiple buffer overflows that can be triggered by remote attackers, leading to a denial of service (application crash). This can occur when a long string is sent to the SMTP server via either the HELO or MAIL FROM commands. **Recommendations** For BusinessMail version 4.60.00, consider restricting access to the SMTP server to minimize the risk of exploitation until a patch is available. As a temporary workaround, limiting the length of strings accepted by the HELO and MAIL FROM commands may help mitigate the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FTPshell Server version 3.38 **Description** The issue allows remote authenticated users to cause a denial of service, resulting in an application crash. This can be achieved by establishing multiple connections and disconnections without properly terminating the session using the QUIT command. **Recommendations** For FTPshell Server version 3.38, consider implementing a limit on the number of concurrent connections to prevent abuse, and ensure that all connections are properly closed using the QUIT command to minimize the risk of a denial of service.

Name of the Vulnerable Software and Affected Versions: IA eMailServer Corporate Edition version 5.2.2 build 1051 Description: The issue is related to a format string vulnerability in the IMAP4 component. This vulnerability can be exploited by remote attackers to cause a denial of service, resulting in an application crash. The exploitation is possible via a LIST command with format string specifiers as the second argument. Recommendations: For IA eMailServer Corporate Edition version 5.2.2 build 1051, consider restricting access to the IMAP4 component until a fix is available, or avoid using format string specifiers in the LIST command to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GoodTech SMTP Server version 5.14 **Description** The issue allows remote attackers to cause a denial of service, resulting in an application crash. This can be achieved by sending a RCPT TO command with an invalid argument, such as an "A" character. **Recommendations** For GoodTech SMTP Server version 5.14, consider restricting access to the RCPT TO command until a patch is available to prevent potential denial of service attacks.

Name of the Vulnerable Software and Affected Versions: Inframail Advantage Server Edition versions 6.0 through 6.7 Description: The issue allows remote attackers to cause a denial of service, resulting in a process crash. This can be achieved via a long SMTP FROM field or possibly an FTP NLST command. Recommendations: For versions 6.0 through 6.7, consider restricting access to the SMTP and FTP services until a fix is available. As a temporary workaround, limit the length of the SMTP FROM field to prevent buffer overflow. Additionally, restrict the use of the FTP NLST command to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: BakBone NetVault version 7.1 Description: The issue concerns the nvstatsmngr.exe process, which fails to properly drop privileges before opening files. This allows local users to gain privileges via the Help menu. Recommendations: For BakBone NetVault version 7.1, consider restricting access to the nvstatsmngr.exe process until a fix is available, and avoid using the Help menu in the affected process to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: BulletProof FTP Server version 2.4.0.31 Description: The BPFTPServer service in BulletProof FTP Server does not properly drop privileges before opening files through the Help menu. This issue allows local users to gain privileges. Recommendations: For version 2.4.0.31, consider restricting access to the Help menu functionality until a proper fix is available, to minimize the risk of privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DMS POP3 versions 1.5.3.27 and earlier **Description** A buffer overflow issue in the pop3svr.exe component allows remote attackers to cause a denial of service, resulting in a service crash. This can be achieved by sending a long `username` or `password`. **Recommendations** For versions 1.5.3.27 and earlier, update to a version later than 1.5.3.27 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Mercury/32 version 4.01a Description: The issue is related to multiple buffer overflows in the IMAP service, which can be exploited by remote authenticated users. This can lead to a denial of service, causing the application to crash, and potentially allow the execution of arbitrary code. The buffer overflows can occur when sending long arguments to various IMAP commands, including `EXAMINE`, `SUBSCRIBE`, `STATUS`, `APPEND`, `CHECK`, `CLOSE`, `EXPUNGE`, `FETCH`, `RENAME`, `DELETE`, `LIST`, `SEARCH`, `CREATE`, and `UNSUBSCRIBE`. Recommendations: For Mercury/32 version 4.01a, consider updating to a newer version that addresses the buffer overflow issues in the IMAP service. As a temporary workaround, restrict access to the IMAP service or limit the length of arguments that can be passed to the affected commands.

Name of the Vulnerable Software and Affected Versions: WS FTP Server version 5.03 2004.10.14 Description: The issue is related to multiple buffer overflows that can be triggered by remote attackers, causing a denial of service (service crash). This can be achieved by sending long commands, specifically the (1) SITE, (2) XMKD, (3) MKD, and (4) RNFR commands. Recommendations: For WS FTP Server version 5.03 2004.10.14, consider restricting access to the SITE, XMKD, MKD, and RNFR commands until a patch is available. As a temporary workaround, limiting the length of input for these commands may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.