MailEnable IMAP Mailbox Name Buffer Overflow Vulnerability

Bugtraq ID:	15492
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 18 2005 12:00AM
Updated:	Nov 18 2005 12:00AM
Credit:	Discovered by Tan Chew Keong.
Vulnerable:	MailEnable MailEnable Professional 1.6 MailEnable MailEnable Enterprise Edition 1.1
Not Vulnerable:	MailEnable MailEnable Professional 1.7

MailEnable IMAP Mailbox Name Buffer Overflow Vulnerability

MailEnable is prone to a buffer overflow vulnerability in multiple IMAP commands. The issue is due to improper bounds checking on the mailbox name argument supplied to various commands.

This issue is reported to affect MailEnable Professional 1.6 with Hotfix MEIMAPS-UPD0511010000.zip and MailEnable Enterprise 1.1 with Hotfix MEIMAPS-UPD0511010000.zip. Other versions may also be vulnerable.

MailEnable IMAP Mailbox Name Buffer Overflow Vulnerability

Exploits by Mati Aharoni and Jacky Altal are available:

• /data/vulnerabilities/exploits/mailenable-imap-examine.py
• /data/vulnerabilities/exploits/muts_mailenable_imap_examine.pm

MailEnable IMAP Mailbox Name Buffer Overflow Vulnerability

Solution:
Fixes are available:


MailEnable MailEnable Enterprise Edition 1.1

• MailEnable ME-10008 IMAP Cumulative Hotfix/Update
  http://www.mailenable.com/hotfix/ME-10008.EXE

MailEnable MailEnable Professional 1.6

• MailEnable ME-10008 IMAP Cumulative Hotfix/Update
  http://www.mailenable.com/hotfix/ME-10008.EXE

MailEnable IMAP Mailbox Name Buffer Overflow Vulnerability

References:

• MailEnable - Hotfix Download Page (MailEnable)
  
• MailEnable Homepage (MailEnable)