MailEnable < 1.7 IMAP Server Multiple Vulnerabilities (ME-100008)

High Nessus Plugin ID 20226


The remote IMAP server is affected by buffer overflow and directory traversal vulnerabilities.


The remote host is running MailEnable, a commercial mail server for Windows.

The IMAP server bundled with the version of MailEnable Professional or Enterprise Edition installed on the remote host is prone to a stack-based buffer overflow when handling an overly-long mailbox name in certain commands. An authenticated attacker may be able to leverage this issue to execute arbitrary code remotely as the SYSTEM user.

It also fails to filter directory traversal sequences from mailbox names passed to the 'CREATE' and 'RENAME' commands. An authenticated attacker can exploit these issues to create arbitrary directories on the affected host and to cause a denial of service by renaming the mail directories of other users.


Upgrade to MailEnable Professional 1.7 or later. Or apply ME-100008, the IMAP Cumulative Hotfix dated November 18th, 2005, referenced in the vendor URL above.

See Also

Plugin Details

Severity: High

ID: 20226

File Name: mailenable_imap_17.nasl

Version: $Revision: 1.17 $

Type: remote

Agent: windows

Family: Windows

Published: 2005/11/20

Modified: 2016/11/28

Dependencies: 10125

Risk Information

Risk Factor: High


Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:mailenable:mailenable

Required KB Items: imap/login, imap/password

Excluded KB Items: imap/false_imap, imap/overflow

Exploit Available: true

Exploit Ease: No exploit is required

Exploited by Nessus: true

Vulnerability Publication Date: 2005/11/18

Reference Information

CVE: CVE-2005-3690, CVE-2005-3691

BID: 15492, 15494

OSVDB: 20929, 20930, 20931