MailEnable < 1.7 IMAP Server Multiple Vulnerabilities (ME-100008)
High Nessus Plugin ID 20226
SynopsisThe remote IMAP server is affected by buffer overflow and directory traversal vulnerabilities.
DescriptionThe remote host is running MailEnable, a commercial mail server for Windows.
The IMAP server bundled with the version of MailEnable Professional or Enterprise Edition installed on the remote host is prone to a stack-based buffer overflow when handling an overly-long mailbox name in certain commands. An authenticated attacker may be able to leverage this issue to execute arbitrary code remotely as the SYSTEM user.
It also fails to filter directory traversal sequences from mailbox names passed to the 'CREATE' and 'RENAME' commands. An authenticated attacker can exploit these issues to create arbitrary directories on the affected host and to cause a denial of service by renaming the mail directories of other users.
SolutionUpgrade to MailEnable Professional 1.7 or later. Or apply ME-100008, the IMAP Cumulative Hotfix dated November 18th, 2005, referenced in the vendor URL above.