Vulnerable Systems:
* Novell NetMail version 3.52C
Immune Systems:
* Novell NetMail version 3.52D
The vulnerability is caused due to a boundary error in the NMAP (Network Messaging Application Protocol) Agent when handling an overly long user name in the "USER" command. This can be exploited to cause a stack-based buffer overflow and allows arbitrary code execution.
Successful exploitation requires valid logon to the NMAP Agent (e.g. if the default NMAP authentication credential has not been changed).
