PT-2008-2868 · Mailenable · Mailenable Enterprise Edition+1

Luigi Auriemma · Published 2008-03-10 · Updated 2018-10-11 · CVE-2008-1276

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MailEnable Professional Edition versions 3.13 and earlier MailEnable Enterprise Edition versions 3.13 and earlier

Description The issue is related to multiple buffer overflows in the IMAP service, which can be exploited by remote authenticated attackers to execute arbitrary code. This can be achieved by providing long arguments to specific commands, including the FETCH, EXAMINE, and UNSUBSCRIBE commands.

Recommendations For MailEnable Professional Edition versions 3.13 and earlier, update to a version later than 3.13 to resolve the issue. For MailEnable Enterprise Edition versions 3.13 and earlier, update to a version later than 3.13 to resolve the issue. As a temporary workaround, consider restricting access to the IMAP service or limiting the length of arguments to the FETCH, EXAMINE, and UNSUBSCRIBE commands until a patch is available.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-1276

Affected Products

Mailenable Enterprise Edition

Mailenable Professional Edition

References · 11

• 🔥 https://exploit-db.com/exploits/5249 · Exploit
• 🔥 http://securityfocus.com/bid/28145 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1276 · Security Note
• http://secunia.com/advisories/29277 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0799/references · Note
• http://securityfocus.com/archive/1/489270/100/0/threaded · Note
• http://aluigi.altervista.org/adv/maildisable-adv.txt · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41058 · Note
• http://securitytracker.com/id?1019565 · Note
• http://xforce.iss.net/xforce/xfdb/41058 · Note
• http://securityreason.com/securityalert/3724 · Note