PT-2006-4171 · Mailenable · Mailenable Standard+2

Published 2006-06-28 · Updated 2018-10-18 · CVE-2006-3277

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions MailEnable Standard versions 1.92 and earlier MailEnable Professional versions 2.0 and earlier MailEnable Enterprise versions 2.0 and earlier

Description The issue allows remote attackers to cause a denial of service, resulting in an application crash. This can be achieved by sending a HELO command with a null byte in the argument, potentially triggering a length inconsistency or a missing argument.

Recommendations For MailEnable Standard versions 1.92 and earlier, apply the MESMTPC hotfix to resolve the issue. For MailEnable Professional versions 2.0 and earlier, apply the MESMTPC hotfix to resolve the issue. For MailEnable Enterprise versions 2.0 and earlier, apply the MESMTPC hotfix to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2006-3277

Affected Products

Mailenable Enterprise

Mailenable Professional

Mailenable Standard

References · 12

• 🔥 https://exploit-db.com/exploits/28103 · Exploit
• http://vupen.com/english/advisories/2006/2520 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3277 · Security Note
• http://divisionbyzero.be/?p=173 · Patch
• http://secunia.com/advisories/20790 · Vendor Advisory
• http://mailenable.com/hotfix/mesmtpc.zip · Patch
• http://divisionbyzero.be/?p=174 · Note
• http://securityfocus.com/archive/1/438374/100/0/threaded · Note
• http://securityfocus.com/bid/18630 · Note
• http://securitytracker.com/id?1016376 · Note
• http://osvdb.org/26791 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27387 · Note