MDaemon IMAP Server Mail Folder Name Format String

medium Nessus Plugin ID 20987

Language:

Synopsis

The remote IMAP server is affected by a format string vulnerability.

Description

The remote host is running Alt-N MDaemon, an SMTP/IMAP server for the Windows operating system family.

The IMAP server component of MDaemon is affected by a format string vulnerability involving folders with format string specifiers in their names . An authenticated attacker can leverage this issue to cause the remote host to consume excessive CPU resources.

Further, given the nature of format string vulnerabilities, this issue is likely to lead to the execution of arbitrary code as LOCAL SYSTEM.

Solution

Upgrade to MDaemon 8.15 or later.

Plugin Details

Severity: Medium

ID: 20987

File Name: mdaemon_imap_format_string.nasl

Version: 1.18

Type: remote

Agent: windows

Family: Windows

Published: 2/28/2006

Updated: 7/14/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

Required KB Items: imap/login, imap/password

Excluded KB Items: imap/false_imap

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2/20/2006

Reference Information

CVE: CVE-2006-0925

BID: 16854

Detections

Analytics