Info

Disclosure

Nov 25, 2004

Discovery

Unknown

Dates

Exploit

Nov 25, 2004

Solution

Unknown

Description

A remote overflow exists in MailEnable's IMAP service. The IMAP service contains boundary errors which result in a stack overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Patch / RCS
Exploit: Exploit Public, Exploit Commercial
Disclosure: OSVDB Verified

Solution

Currently, there are no known workarounds or upgrades to correct this issue. However, vendor has released a patch to address this vulnerability.

Products

MailEnable Pty. Ltd.	MailEnable Professional Edition	1.52
MailEnable Pty. Ltd.	MailEnable Enterprise Edition	1.01

References

Security Tracker: 1012327
Bugtraq ID: 11755
Related OSVDB ID: 12136
Secunia Advisory ID: 13318
ISS X-Force ID: 18285 18286
CVE ID: 2004-2501 (see also: NVD)
Milw0rm: 658
Exploit Database: 658
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2004-11/0349.html
http://archives.neohapsis.com/archives/fulldisclosure/2004-11/1193.html
Vendor Specific Solution URL: http://mailenable.com/hotfix/MEIMAPS-HF041125.zip
Other Advisory URL: http://www.hat-squad.com/en/000102.html
Vendor URL: http://www.mailenable.com
Generic Exploit URL: http://www.saintcorporation.com/cgi-bin/exploit_info/mailenable_imap_command

Credit

Nima Majidi - nima_majidihat-squad.com -
idespinner - idespinnerhat-squad.com -
class101 - class101dfind.kd-team.com -

Direct URL: http://osvdb.org/12135

Info

Disclosure

Discovery

Dates

Exploit

Solution

Description

Classification

Solution

Products

MailEnable Pty. Ltd.

MailEnable Professional Edition

MailEnable Enterprise Edition

References

Credit