Info

Disclosure

Mar 16, 2006

Discovery

Unknown

Dates

Exploit

Mar 19, 2006

Solution

Unknown

Description

A remote overflow exists in MERCUR Messaging Server IMAP service. The product fails to perform boundary checks on login and select commands resulting in a stack-based overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Solution Unknown
Exploit: Exploit Public, Exploit Commercial

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

Atrium Software

MERCUR Messaging Server

5.0 SP3

References

Milw0rm: 1592 3133 3540
Exploit Database: 1592 3133 3540
Bugtraq ID: 17138
Secunia Advisory ID: 19267
CVE ID: 2006-1255 (see also: NVD)
Metasploit ID: 23950
ISS X-Force ID: 25290
VUPEN Advisory: ADV-2006-0977
Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/1837.html
http://archives.neohapsis.com/archives/fulldisclosure/2006-02/1936.html
http://archives.neohapsis.com/archives/fulldisclosure/2006-02/2050.html
Generic Exploit URL: http://immunitysec.com
http://metasploit.com/svn/framework3/trunk/modules/exploits/windows/imap/mercur_imap_select_overflow.rb
http://www.saintcorporation.com/cgi-bin/exploit_info/mercur_imap_login
Vendor URL: http://www.atrium-software.com/
Other Advisory URL: http://www.security.nnov.ru/news2164.html

Credit

Tim Taylor - tim.taylorgmx.ch -

Direct URL: http://osvdb.org/23950