Detections
Analytics

MailEnable HTTPMail Service Authorization Header Handling Remote DoS

medium Nessus Plugin ID 14654

Language:

Synopsis

The remote web server is affected by a denial of service flaw.

Description

The remote host is running an instance of MailEnable that has a flaw in the HTTPMail service (MEHTTPS.exe) in the Professional and Enterprise Editions. The flaw can be exploited by issuing an HTTP request with a malformed Authorization header, which causes a NULL pointer dereference error and crashes the HTTPMail service.

Solution

Upgrade to MailEnable Professional / Enterprise 1.19 or later.

See Also

http://www.oliverkarow.de/research/MailWebHTTPAuthCrash.txt

https://seclists.org/bugtraq/2004/May/172

Plugin Details

Severity: Medium

ID: 14654

File Name: mailenable_httpmail_authorization_dos.nasl

Version: 1.16

Type: remote

Family: CGI abuses

Published: 9/3/2004

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: cpe:/a:mailenable:mailenable

Patch Publication Date: 5/16/2004

Vulnerability Publication Date: 5/11/2004

Reference Information

CVE: CVE-2004-2726