PT-2005-5139 · Mailenable · Mailenable Professional+1

Tim Shelton · Published 2005-12-21 · Updated 2008-09-05 · CVE-2005-4456

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MailEnable Professional versions 1.71 and prior MailEnable Enterprise versions 1.1 and prior

Description The issue is related to multiple buffer overflows in MailEnable, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via long commands such as LIST, LSUB, and UID FETCH. These vulnerabilities can be exploited by an authenticated user to cause a DoS via malformed arguments or to cause a stack-based buffer overflow via an overly long argument.

Recommendations For MailEnable Professional versions 1.71 and prior, apply patch ME-10009 to resolve the issue. For MailEnable Enterprise versions 1.1 and prior, apply patch ME-10009 to resolve the issue. As a temporary workaround, consider restricting access to the IMAP service or disabling the UID FETCH, LIST, and LSUB commands until a patch is applied.

Exploit

Fix

Related Identifiers

CVE-2005-4456

Affected Products

Mailenable Enterprise

Mailenable Professional

References · 9

• 🔥 https://exploit-db.com/exploits/1378 · Exploit
• 🔥 http://securityfocus.com/bid/15985 · Exploit
• 🔥 http://seclists.org/lists/fulldisclosure/2005/Dec/1036.html · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-4457 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2005-4456 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-4456 · Security Note
• http://secunia.com/advisories/18134 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/040388.html · Note
• http://securitylab.ru/vulnerability/243324.php · Note