PT-2003-1272 · Alt N Technologies · Mdaemon

Published 2003-03-18 · Updated 2008-09-05 · CVE-2002-1539

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions MDaemon versions 6.0.0 through 6.0.7

Description The issue allows remote authenticated users to cause a denial of service via long arguments in the DELE or UIDL commands, resulting in a buffer overflow. By sending a DELE or UIDL command of more than 32 bytes to a vulnerable host, a remote attacker with a valid mail account could overflow a buffer and cause all of MDaemon's mail services to crash. MDaemon must be restarted to regain normal functionality.

Recommendations For MDaemon versions 6.0.0 through 6.0.7, consider restricting access to the DELE and UIDL commands until a patch is available to prevent the buffer overflow. As a temporary workaround, limit the length of arguments accepted by these commands to prevent the denial of service.

Exploit

Fix

Related Identifiers

CVE-2002-1539

Affected Products

Mdaemon

References · 8

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-10/0382.html · Exploit
• 🔥 http://securityfocus.com/bid/6053 · Exploit
• 🔥 https://exploit-db.com/exploits/21965 · Exploit
• http://iss.net/security_center/static/10488.php · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1539 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2002-1539 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1539 · Note
• http://xforce.iss.net/xforce/xfdb/10488 · Note