PT-2004-2159 · Mercury · Mercury/32

Johnh + 2 · Published 2004-12-15 · Updated 2017-07-11 · CVE-2004-1211

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Mercury/32 version 4.01a

Description: The issue is related to multiple buffer overflows in the IMAP service, which can be exploited by remote authenticated users. This can lead to a denial of service, causing the application to crash, and potentially allow the execution of arbitrary code. The buffer overflows can occur when sending long arguments to various IMAP commands, including EXAMINE, SUBSCRIBE, STATUS, APPEND, CHECK, CLOSE, EXPUNGE, FETCH, RENAME, DELETE, LIST, SEARCH, CREATE, and UNSUBSCRIBE.

Recommendations: For Mercury/32 version 4.01a, consider updating to a newer version that addresses the buffer overflow issues in the IMAP service. As a temporary workaround, restrict access to the IMAP service or limit the length of arguments that can be passed to the affected commands.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2004-1211

Affected Products

Mercury/32

References · 16

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/imap/mercury_rename.rb · Exploit
• 🔥 https://exploit-db.com/exploits/1159 · Exploit
• 🔥 https://exploit-db.com/exploits/3561 · Exploit
• 🔥 http://securityfocus.com/bid/11775 · Exploit
• 🔥 https://exploit-db.com/exploits/670 · Exploit
• 🔥 https://exploit-db.com/exploits/668 · Exploit
• 🔥 https://exploit-db.com/exploits/4316 · Exploit
• 🔥 https://exploit-db.com/exploits/16484 · Exploit
• 🔥 https://exploit-db.com/exploits/663 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1211 · Security Note
• http://secunia.com/advisories/13348 · Vendor Advisory
• http://lists.grok.org.uk/pipermail/full-disclosure/2004-December/029701.html · Note
• http://home.kabelfoon.nl/~jaabogae/han/m_401b.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18318 · Note
• http://osvdb.org/12508 · Note