Computalynx CMail POP3 Server DELE Function Denial Of Service Vulnerability

Bugtraq ID:	5595
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 29 2002 12:00AM
Updated:	Aug 29 2002 12:00AM
Credit:	Vulnerability discovery credited to <[email protected]>.
Vulnerable:	Computalynx CMail 2.4.12 AV Computalynx CMail 2.4.12 Computalynx CMail 2.4.7 Computalynx CMail 2.4 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:	Computalynx CMail 2.4.15 AV Computalynx CMail 2.4.15

Computalynx CMail POP3 Server DELE Function Denial Of Service Vulnerability

CMail is a commercially available email server distributed by Computalynx. It is available for Microsoft Windows operating systems.

It has been reported that a memory corruption vulnerability exists in CMail. The POP3 server included with CMail does not properly handle some types of requests. By submitting a maliciously crafted request to the POP3 server, an attacker could crash the system, resulting in a denial of service.

Computalynx CMail POP3 Server DELE Function Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Computalynx CMail POP3 Server DELE Function Denial Of Service Vulnerability

Solution:
The vendor has released Computalynx CMail versions 2.4.15 and 2.4.15AV. These versions are not affected by this issue. Users are advised to contact the vendor to obtain the fixed versions.

Computalynx CMail POP3 Server DELE Function Denial Of Service Vulnerability

References:

• Computalynx Home Page (Computalynx)