PT-2006-6920 · Mailenable · Mailenable Professional+1

Published 2006-12-05 · Updated 2019-10-03 · CVE-2006-6291

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MailEnable Professional versions 1.6 through 1.83 MailEnable Professional versions 2.0 through 2.33 MailEnable Enterprise versions 1.1 through 1.40 MailEnable Enterprise versions 2.0 through 2.33

Description The issue is related to a stack overflow in the IMAP module, which can be triggered by remote authenticated users. This is achieved by sending a long argument containing * (asterisk) and ? (question mark) characters to the DELETE command. The result is a denial of service, causing the system to crash.

Recommendations For MailEnable Professional versions 1.6 through 1.83, apply the ME-10020 hotfix. For MailEnable Professional versions 2.0 through 2.33, apply the ME-10020 hotfix. For MailEnable Enterprise versions 1.1 through 1.40, apply the ME-10020 hotfix. For MailEnable Enterprise versions 2.0 through 2.33, apply the ME-10020 hotfix.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2006-6291

Affected Products

Mailenable Enterprise

Mailenable Professional

References · 11

• http://mailenable.com/hotfix · Patch
• http://secunia.com/secunia_research/2006-71/advisory · Vendor Advisory
• http://secunia.com/advisories/23080 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6291 · Security Note
• http://vupen.com/english/advisories/2006/4778 · Vendor Advisory
• http://securityfocus.com/bid/21362 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6291 · Note
• http://securitytracker.com/id?1017319 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30614 · Note
• http://securityfocus.com/archive/1/453118/100/100/threaded · Note
• http://securitytracker.com/id?1017276 · Note