PT-2003-2422 · Clearswift · Mailsweeper For Smtp

Published 2003-12-31 · Updated 2017-07-29 · CVE-2003-1477

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MAILsweeper for SMTP versions 4.3.6 through 4.3.7

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by sending a PowerPoint attachment. This attachment can either be corrupt or contain embedded objects, triggering the denial of service.

Recommendations For versions 4.3.6 and 4.3.7, consider restricting the handling of PowerPoint attachments with embedded objects or corrupt files until a fix is available. As a temporary workaround, disabling the processing of such attachments can help minimize the risk of CPU consumption denial of service attacks.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2003-1477

Affected Products

Mailsweeper For Smtp

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2003-1477 · Security Note
• http://securityfocus.com/bid/7562 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/12052 · Note
• http://clearswift.com/download/bin/Patches/ReadMe_SMTP_438.htm · Note