MailEnable Multiple IMAP Remote Buffer Overflow Vulnerabilities

Bugtraq ID:	15985
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 18 2005 12:00AM
Updated:	Nov 18 2005 12:00AM
Credit:	Discovered by Tim Shelton.
Vulnerable:	MailEnable MailEnable Professional 1.7 MailEnable MailEnable Enterprise Edition 1.1
Not Vulnerable:

MailEnable Multiple IMAP Remote Buffer Overflow Vulnerabilities

MailEnable is prone to multiple remote IMAP service buffer overflow vulnerabilities. These issues are due to a lack of sufficient bounds checking of user-supplied data prior to copying it to an insufficiently sized memory buffer.

This issue is reported to affect MailEnable Professional 1.7 and MailEnable Enterprise 1.1. Other versions may also be vulnerable.

MailEnable Multiple IMAP Remote Buffer Overflow Vulnerabilities

The following IMAP commands are sufficient to demonstrate these issues:

'02 LIST /.:/' + Ax5000
'02 LSUB' /.:/ ('A' x 5000) request
'02 UID FETCH /.:/' AX5000 ' FLAGS'
'02 UID FETCH /...'x5 ' FLAGS'
'02 UID FETCH '/\'x5000 '

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

MailEnable Multiple IMAP Remote Buffer Overflow Vulnerabilities

Solution:
Fixes are available:


MailEnable MailEnable Enterprise Edition 1.1

• MailEnable ME-10009 IMAP Cumulative Hotfix/Update
  http://www.mailenable.com/hotfix/ME-10009.EXE

MailEnable MailEnable Professional 1.7

• MailEnable ME-10009 IMAP Cumulative Hotfix/Update
  http://www.mailenable.com/hotfix/ME-10009.EXE

MailEnable Multiple IMAP Remote Buffer Overflow Vulnerabilities

References:

• MailEnable - Hotfix Download Page (MailEnable)
  
• MailEnable Homepage (MailEnable)