|
|
|
|
| |
| MailEnable's "mail server software provides a powerful, scalable hosted messaging platform for Microsoft Windows. MailEnable offers stability, unsurpassed flexibility and an extensive feature set which allows you to provide cost-effective mail services". Multiple NTLM related pre-authentication vulnerabilities have been discovered in MailEnable's SMTP server, these vulnerabilities can be used to cause the product to execute arbitrary code or to cause it to no longer respond to legitimate requests. |
| |
Credit:
The information has been provided by Mu Security.
The original article can be found at: http://labs.musecurity.com/advisories/MU-200609-01.txt
|
| |
Vulnerable Systems:
* MailEnable Professional version 2.0
* MailEnable Enterprise version 2.0
All three pre-authentication vulnerabilities are in the SMTP connector during the NTLM authentication process, two of which can lead to arbitrary code execution on the server. NTLM authentication is disabled by default, but can be turned on by the administrator using the Messaging Manager. NTLM authentication is unavailable in the Standard versions of MailEnable.
The first vulnerability is a buffer overflow while processing the signature field of NTLM Type1 messages, leading to arbitrary code execution.
The second vulnerability is an out of bounds read while processing security buffers in the base64 encoded NTLM Type1 message, leading to a denial of service.
The third vulnerability is an out of bounds read during base64 decoding of Type3 messages, leading to arbitrary code execution.
Vendor Response / Solution:
All users of MailEnable are recommended to immediately apply the hotfixes available from the following URL:
http://www.mailenable.com/hotfix/MESMTP-060930.zip
All hotfixes are available from:
http://www.mailenable.com/hotfix
Mu Security would like to thank the MailEnable team for timely remediation of these vulnerabilities.
History:
09/25/06 - First contact with the vendor
09/27/06 - Hotfix available for the vulnerabilities
09/29/06 - Advisory released
|
|
|
|
|
