Ipswitch Collaboration Suite and IMail Server IMAPD LIST Command Denial Of Service Vulnerability

Bugtraq ID:	15753
Class:	Boundary Condition Error
CVE:	CVE-2005-2923
Remote:	Yes
Local:	No
Published:	Dec 06 2005 12:00AM
Updated:	Jul 12 2009 05:56PM
Credit:	Sebastian Apelt is credited with the discovery of this vulnerability.
Vulnerable:	Ipswitch Ipswitch Collaboration Suite 2.0 1 Ipswitch Ipswitch Collaboration Suite Ipswitch IMail 8.20 Ipswitch IMail 8.2
Not Vulnerable:	Ipswitch Ipswitch Collaboration Suite 2.0 2 Ipswitch IMail 8.22 Ipswitch IMail 8.2 Hotfix 2

Ipswitch Collaboration Suite and IMail Server IMAPD LIST Command Denial Of Service Vulnerability

Ipswitch Collaboration Suite and IMail Server are prone to a remote denial of service vulnerability.

Successful exploitation will cause the affected server to crash, effectively denying service to legitimate users.

Ipswitch Collaboration Suite and IMail Server IMAPD LIST Command Denial Of Service Vulnerability

No exploit is required.

Ipswitch Collaboration Suite and IMail Server IMAPD LIST Command Denial Of Service Vulnerability

Solution:
The vendor has released fixes to address this issue:


Ipswitch Ipswitch Collaboration Suite 2.0 1

• Ipswitch Ipswitch Collaboration Suite 2.02
  http://www.ipswitch.com/support/ics/updates/ics202.asp

Ipswitch IMail 8.20

• Ipswitch IMail Server 8.22 Patch
  http://www.ipswitch.com/support/imail/releases/imail_professional/im82 2.asp

Ipswitch Collaboration Suite and IMail Server IMAPD LIST Command Denial Of Service Vulnerability

References:

• iDEFENSE Security Advisory 12.06.05: Ipswitch IMail IMAP List Command DoS Vulner (iDEFENSE)
  
• IMail Home Page (Ipswitch)