Advisories » MailEnable IMAP Service Multiple Remote Denial of Service and Buffer Overflow Vulnerabilities

Release Date:	10/03/2008	Severity:	Moderately Critical
SecWatch Advisory:	SWID1020608	Cause:	Boundary error
Solution Status:	Unpatched	Impact:	Denial of service Execution of arbitrary code
Exploit Status:	Exploit Available	Access Vector:	From remote

Affected Software:	MailEnable Enterprise Edition 3.x MailEnable Professional 3.x

Description:

Multiple vulnerabilities in MailEnable have been reported, which can be exploited by remote users to trigger denial of service conditions or to compromise a vulnerable system.

1) Boundary errors exist when handling overly long arguments passed to the FETCH, EXAMINE, and UNSUBSCRIBE commands within the IMAP service (MEIMAPS.EXE), which can be exploited to cause buffer overflow and execute arbitrary code.

2) NULL-pointer dereference errors exist when handling no arguments passed to the SEARCH and APPEND commands within the IMAP service (MEIMAPS.EXE), which can be exploited to crash the service.

Affected:

MailEnable Professional version 3.13. Other versions may also be affected.

Proof of Concept:

Demonstration exploit code is available:
http://secwatch.org/exploits/2008/03/imap.pl.info

Solution:

There was no vendor-supplied solution at the time of entry.

Credits:

Luigi Auriemma