Ipswitch IMail Server List Mailer 'imailsrv.exe' Memory Corruption Denial of Service Vulnerability

Bugtraq ID:	43279
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Sep 15 2010 12:00AM
Updated:	Sep 15 2010 12:00AM
Credit:	Abysssec
Vulnerable:	Ipswitch IMail Server 11.02 Ipswitch IMail Server 11.01
Not Vulnerable:

Ipswitch IMail Server List Mailer 'imailsrv.exe' Memory Corruption Denial of Service Vulnerability

Ipswitch IMail Server is prone to a denial-of-service vulnerability because it fails to properly validate user-supplied data.

Attackers can exploit this issue to cause the 'imailsrv.exe' Queue Manager service to crash, triggering a denial-of-service. Due to the nature of this issue, attackers could leverage the vulnerability to execute arbitrary code with SYSTEM-level privileges; this has not been confirmed.

Ipswitch IMail Server versions prior to 11.02 Patch 2 are vulnerable.

Ipswitch IMail Server List Mailer 'imailsrv.exe' Memory Corruption Denial of Service Vulnerability

Solution:
Vendor updates are available. Please contact the vendor for more information.


Ipswitch IMail Server 11.02

• Ipswitch SmtpDLL.dll
  http://ftp.ipswitch.com/ipswitch/product_downloads/SmtpDLL.dll

Ipswitch IMail Server List Mailer 'imailsrv.exe' Memory Corruption Denial of Service Vulnerability

References:

• IMail Server Homepage (Ipswitch)
  
• IMail v11.02 Patch 2 (Ipswitch)
  
• MOAUB #15 �?? Ipswitch Imail Server List Mailer Reply-To Address memory corruption (Abysssec Research)