full-disclosure - Multiple vulnerabilities in MailEnable Professional/Enterprise 3.13

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20080307200040.e3b46e97.aluigi@autistici.org>
Date: Fri, 7 Mar 2008 20:00:40 +0100
From: Luigi Auriemma <aluigi@...istici.org>
To: bugtraq@...urityfocus.com, news@...uriteam.com,
	full-disclosure@...ts.grok.org.uk, vuln@...unia.com,
	packet@...ketstormsecurity.org
Subject: Multiple vulnerabilities in MailEnable
	Professional/Enterprise 3.13

#######################################################################

                             Luigi Auriemma

Application:  MailEnable Professional and Enterprise
              http://www.mailenable.com
Versions:     <= 3.13
Platforms:    Windows
Bugs:         A] multiple post-auth buffer-overflows
              B] NULL pointers
Exploitation: remote, versus the IMAP service
Date:         07 Mar 2008
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    aluigi.org

#######################################################################

1) Introduction
2) Bugs
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

MailEnable is a mail server for Windows which supports various
protocols like SMTP, POP3, IMAP, webmail and a HTTPMail service.

#######################################################################

=======
2) Bugs
=======

--------------------------------------
A] multiple post-auth buffer-overflows
--------------------------------------

The IMAP service (MEIMAPS.exe) of MailEnable is affected by some
buffer-overflow vulnerabilities caused by too long parameters passed
to the FETCH, EXAMINE and UNSUBSCRIBE commands allowing an attacker to
execute malicious code.

All the vulnerable commands require an account to be exploited.

----------------
B] NULL pointers
----------------

The IMAP service is affected also by two NULL pointer vulnerabilities
exploitable through the omission of the required arguments for the
SEARCH and APPEND commands, where the first can be used by
unauthenticated attackers too.

#######################################################################

===========
3) The Code
===========

http://aluigi.org/poc/maildisable.zip

#######################################################################

======
4) Fix
======

No fix

#######################################################################

--- 
Luigi Auriemma
http://aluigi.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/