Avaya Modular Messaging POP3 Remote Denial of Service Vulnerability

Bugtraq ID:	16024
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Dec 21 2005 12:00AM
Updated:	Dec 21 2005 12:00AM
Credit:	Reported by the vendor.
Vulnerable:	Avaya Modular Messaging (MSS) 2.0 SP4 Avaya Modular Messaging (MSS) 2.0 Avaya Modular Messaging (MSS) 1.1
Not Vulnerable:

Avaya Modular Messaging POP3 Remote Denial of Service Vulnerability

Avaya Modular Messaging Message Storage Server POP3 service is prone to a remote denial of service vulnerability.

An attacker can send specially crafted packets to the service to trigger an infinite loop that eventually leads to a crash or hang.

Avaya Modular Messaging 2.0 SP4 and prior versions are vulnerable.

Avaya Modular Messaging POP3 Remote Denial of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Avaya Modular Messaging POP3 Remote Denial of Service Vulnerability

Solution:
Avaya has released advisory ASA-2005-235 to address this issue. Users are recommended to apply patch number A1312pt+p.

Avaya Modular Messaging POP3 Remote Denial of Service Vulnerability

References:

• ASA-2005-235 - Message Storage Server POP3 Denial of Service (Avaya)
  
• Avaya Home Page (Avaya)
  
• MSS 2.0 SP4 patch - update to resolve security alert for the POP3 protocol (Avaya)