PT-2005-4446 · Mailenable · Mailenable Professional+1

Published 2005-11-19 · Updated 2017-07-11 · CVE-2005-3690

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MailEnable Professional versions 1.6 and earlier MailEnable Enterprise versions 1.1 and earlier

Description The issue is related to a stack-based buffer overflow in the IMAP service of MailEnable, which can be exploited by remote attackers to execute arbitrary code. This can be achieved by providing a long mailbox name in various IMAP commands, including select, create, delete, rename, subscribe, or unsubscribe.

Recommendations For MailEnable Professional versions 1.6 and earlier, update to a version later than 1.6 to resolve the issue. For MailEnable Enterprise versions 1.1 and earlier, update to a version later than 1.1 to resolve the issue. As a temporary workaround, consider restricting access to the IMAP service or limiting the length of mailbox names to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-3690

Affected Products

Mailenable Enterprise

Mailenable Professional

References · 10

• http://mailenable.com/hotfix · Patch
• http://secunia.com/secunia_research/2005-59/advisory · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3690 · Security Note
• http://secunia.com/advisories/17633 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23110 · Note
• http://securitytracker.com/id?1015239 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0581.html · Note
• http://vupen.com/english/advisories/2005/2484 · Note
• http://osvdb.org/20929 · Note
• http://securityfocus.com/bid/15492 · Note