Ipswitch IMail Format String and 'LIST' Command DoS

High Nessus Network Monitor Plugin ID 3317

Synopsis

The remote host is vulnerable to a format string flaw.

Description

The remote host is running a version of the Ipswitch Collaboration Suite / Ipswitch IMail IMAP server that is prone to a format string flaw. An attacker exploiting this flaw would send a malformed string to the remote mail server. Successful exploitation would result in the attacker executing arbitrary code. The affected SMTP arguments are: EXPN, MAIL, MAIL FROM, and RCPT TO. In addition, the remote host is vulnerable to a flaw when processing very long 'LIST' commands. Successful exploitation results in the remote service crashing.

Solution

Upgrade to version 8.22.0 of IMail or version 2.0.0.2 of the Ipswitch Collaboration Suite.

See Also

http://www.idefense.com/application/poi/display?id=346&type=vulnerabilities

Plugin Details

Severity: High

ID: 3317

File Name: 3317.prm

Family: SMTP Servers

Published: 2005/12/07

Modified: 2016/01/15

Dependencies: 2004, 2005

Risk Information

Risk Factor: High

CVSSv2

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSSv3

Base Score: 7.3

Temporal Score: 6.4

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS3#E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ipswitch:imail

Reference Information

CVE: CVE-2005-2931, CVE-2005-2923

BID: 15752, 15753