PT-2010-4125 · Mailenable · Mailenable

Soroush Dalili · Published 2010-09-15 · Updated 2018-10-10 · CVE-2010-2580

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions MailEnable versions 3.x through 4.25

Description The issue concerns the SMTP service in MailEnable, where it fails to properly check the length of certain parameters. This can be exploited by remote attackers to cause a denial of service, leading to a crash. The attack can be initiated by sending a long email address in the MAIL FROM command or a long domain name in the RCPT TO command. This triggers an unhandled invalid parameter error.

Recommendations For MailEnable versions 3.x through 4.25, consider restricting access to the SMTP service until a fix is available. As a temporary workaround, limit the length of email addresses and domain names that can be processed by the MAIL FROM and RCPT TO commands to prevent the denial of service.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-2580

Affected Products

Mailenable

References · 11

• http://mailenable.com/hotfix · Vendor Advisory
• http://secunia.com/advisories/41175 · Vendor Advisory
• http://secunia.com/secunia_research/2010-112 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2580 · Security Note
• http://securityfocus.com/archive/1/513648/100/0/threaded · Note
• http://mailenable.com/Professional-ReleaseNotes.txt · Note
• http://securityfocus.com/bid/43182 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2580 · Note
• http://mailenable.com/Enterprise-ReleaseNotes.txt · Note
• http://mailenable.com/Standard-ReleaseNotes.txt · Note
• http://securitytracker.com/id?1024427 · Note