|
|
| |
Credit:
The information has been provided by Dmitriy Pletnev.
The original article can be found at: http://secunia.com/secunia_research/2010-112/
|
| |
Vulnerable Systems:
* MailEnable version 4.25 Standard
* MailEnable version 4.25 Professional
* MailEnable version 4.25 Enterprise
Immune Systems:
* MailEnable version 4.26
Two problems were discovered:
1) An insufficient length check when appending data to a predefined log message into a buffer using strcat_s() may result in an unhandled invalid parameter error. This can be exploited to crash the SMTP service (MESMTPC.exe) via an overly long email address in the "MAIL FROM" command.
2) An insufficient length check when copying data with a predefined log message into a buffer using strcpy_s() may result in an unhandled invalid parameter error. This can be exploited to crash the SMTP service (MESMTPC.exe) via an overly long domain name in the "RCPT TO" command.
Patch Availability:
Apply hotfix ME-10044.
CVE Information:
CVE-2010-2580
Disclosure Timeline:
06/09/2010 - Vulnerability details provided to the vendor.
13/09/2010 - Vendor releases fixed version.
13/09/2010 - Public disclosure
|
|
|
