PT-2005-1134 · Gfi+1 · Gfi Mailsecurity For Exchange+4

Published 2005-01-03 · Updated 2008-09-05 · CVE-2004-1312

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft HTML library (affected versions not specified) GFI MailEssentials for Exchange versions 9 and 10 GFI MailSecurity for Exchange version 8

Description A bug in the HTML parser of a Microsoft HTML library may allow remote attackers to cause a denial of service via certain strings. This issue has been reported in GFI MailEssentials for Exchange 9 and 10, and GFI MailSecurity for Exchange 8, resulting in emails remaining in IIS or Exchange mail queues.

Recommendations For GFI MailEssentials for Exchange versions 9 and 10, consider implementing input validation to prevent malicious strings from being processed. For GFI MailSecurity for Exchange version 8, restrict the processing of emails that contain potentially malicious HTML content. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-1312

Affected Products

Exchange Server

Gfi Mailessentials For Exchange

Gfi Mailsecurity For Exchange

Iis

Html Library

References · 5

• http://kbase.gfi.com/showarticle.asp?id=KBID002249 · Vendor Advisory
• http://csis.dk/default.asp?m=1&a=194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1312 · Security Note
• http://securityfocus.com/bid/12148 · Note
• http://secunia.com/advisories/13708 · Note