Novell NetMail IMAP Unspecified Buffer Overflow Vulnerability

Bugtraq ID:	15491
Class:	Boundary Condition Error
CVE:	CVE-2005-3314
Remote:	Yes
Local:	No
Published:	Nov 18 2005 12:00AM
Updated:	Feb 01 2008 05:38PM
Credit:	Discovered by Sebastian Apelt.
Vulnerable:	Novell NetMail 3.52 D
Not Vulnerable:

Novell NetMail IMAP Unspecified Buffer Overflow Vulnerability

Novell NetMail is prone to a buffer-overflow vulnerability in an unspecified IMAP command. Successful exploits may result in a denial of service or arbitrary code execution.

NetMail 3.52D is affected, but earlier versions may also be vulnerable.

Details regarding the precise nature of this vulnerability are not currently available. We will update this BID as more information emerges.

Novell NetMail IMAP Unspecified Buffer Overflow Vulnerability

The following exploit code is available as a module for the Metasploit Framework:

• /data/vulnerabilities/exploits/15491-novell_netmail_status.rb

Novell NetMail IMAP Unspecified Buffer Overflow Vulnerability

Solution:
Novell has released fixes to address this issue.


Novell NetMail 3.52 D

• Novell nm352e_ftf1_lx.tgz
  NetMail 3.52e FTF 1 for Linux
  http://support.novell.com/servlet/filedownload/sec/ftf/nm352e_ftf1_lx. tgz


• Novell nm352e_ftf1_nw.zip
  NetMail 3.52e FTF 1 for NetWare
  http://support.novell.com/servlet/filedownload/sec/ftf/nm352e_ftf1_nw. zip


• Novell nm352e_ftf1_win.zip
  NetMail 3.52e FTF 1 for Windows
  http://support.novell.com/servlet/filedownload/sec/ftf/nm352e_ftf1_win .zip

Novell NetMail IMAP Unspecified Buffer Overflow Vulnerability

References:

• NetMail 3.52e FTF 1 for Linux - TID2972665 (Novell)
  
• NetMail 3.52e FTF 1 for NetWare - TID2972672 (Novell)
  
• NetMail 3.52e FTF 1 for Windows - TID2972673 (Novell)