PT-2003-2129 · Mercury · Mercur Mailserver

Published 2003-12-31 · Updated 2017-07-11 · CVE-2003-1177

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MERCUR Mailserver version 4.2 before SP3a

Description A buffer overflow issue exists in the base64 decoder of the affected software, potentially allowing remote attackers to cause a denial of service or execute arbitrary code. This can be achieved by sending a long AUTH command to the POP3 server or a long AUTHENTICATE command to the IMAP server.

Recommendations For MERCUR Mailserver version 4.2 before SP3a, update to a version that includes SP3a or later to resolve the issue. As a temporary workaround, consider restricting access to the POP3 and IMAP servers until the update can be applied.

Exploit

Fix

Related Identifiers

CVE-2003-1177

Affected Products

Mercur Mailserver

References · 10

• 🔥 http://securityfocus.com/bid/8889 · Exploit
• 🔥 https://exploit-db.com/exploits/23267 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2003-q4/1459.html · Exploit
• 🔥 http://securityfocus.com/bid/8861 · Exploit
• 🔥 http://securiteam.com/windowsntfocus/6U00N1P8KC.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1177 · Security Note
• http://secunia.com/advisories/10038 · Patch
• http://osvdb.org/2688 · Note
• http://atrium-software.com/mail%20server/pub/mcr42sp3a.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13468 · Note