Ipswitch IMail Server < 11.02 Multiple Vulnerabilities

Critical Nessus Network Monitor Plugin ID 5600

Synopsis

The remote mail server is vulnerable to multiple attack vectors.

Description

The remote host is running Ipswitch IMail server.

Versions of IMail earlier than 11.02 are potentially affected by multiple vulnerabilities :

- By sending a specially crafted message to imailsrv.exe with multiple 'Reply-To' headers set, it may be possible for a remote unauthenticated attacker to execute arbitrary code on the remote system. (ZDI-10-126)

- By sending a specially crafted message containing '?Q' operator, it may be possible for a remote authenticated attacker to execute arbitrary code on the remote system with SYSTEM privileges. (ZDI-10-127)

- By sending a specially crafted message with an overly long '-NOTIFY' argument, it may be possible for a remote unauthenticated attacker to execute arbitrary code on the remote system. (ZDI-10-128)

Solution

Upgrade to Ipswitch IMail Server version 11.02 or later.

See Also

http://www.zerodayinitiative.com/advisories/ZDI-10-126

http://www.zerodayinitiative.com/advisories/ZDI-10-127

http://www.zerodayinitiative.com/advisories/ZDI-10-128

http://archives.neohapsis.com/archives/fulldisclosure/2010-07/0231.html

http://archives.neohapsis.com/archives/fulldisclosure/2010-07/0232.html

http://archives.neohapsis.com/archives/fulldisclosure/2010-07/0233.html

Plugin Details

Severity: Critical

ID: 5600

Family: SMTP Servers

Published: 2010/07/16

Modified: 2016/11/23

Dependencies: 2004, 2005

Nessus ID: 47743

Risk Information

Risk Factor: Critical

CVSSv2

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSSv3

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS3#E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ipswitch:imail_server

Patch Publication Date: 2010/07/15

Vulnerability Publication Date: 2010/07/15

Reference Information

BID: 41717, 41718, 41719