SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
IT News
Search
SecurityAlert Database
About SecurityAlert
ExploitAlert Database
SecurityReason Research
WLB
WLB Database
Send to WLB
About WLB
Services
Security Audit
Schedule
Prices of services
Contact
RSS
SecurityReason IT News
SecurityAlert
World Laboratory of Bugtraq
ExploitAlert
Apache
PHP
Corporate
Contact
About SecurityReason
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com
Home arrow SecurityAlert Database

Arrow  Topic :

MailEnable IMAP DOS


Arrow  SecurityAlert : 205
Arrow  CVE : CVE-2005-3813
Arrow  SecurityRisk : Medium  Security Risk Medium  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : No
Arrow  Exploit Available : Yes
Arrow  Credit : Josh Zlatin
Arrow  Published : 25.11.2005

Arrow  Affected Software : MailEnable Pro 1.7
MailEnable Enterprise 1.1



Arrow  Advisory Content :  

Synopsis: MailEnable Imap Remote DOS.

Product: MailEnable Pro
MailEnable Enterprise
http://www.mailenable.com

Version: Confirmed on MailEnable Pro 1.7 and MailEnable Enterprise 1.1

Author: Josh Zlatin-Amishav

Date: November 24, 2005

Background:
MailEnable's mail server software provides a powerful, scalable hosted
messaging platform for Microsoft Windows. MailEnable offers stability,
unsurpassed flexibility and an extensive feature set which allows you to
provide cost-effective mail services.

Issue:
In working with researchers at Tenable Network Security, I have come
across
a Denial of Service attack in the MailEnable Pro and MailEnable Enterprise
IMAP server. It is possible to remotely crash the IMAP server by sending a

rename request with non existant mailbox names

PoC:
telnet localhost 143
a1 login josh byebye
a2 rename foo bar

where josh and byebye are the login credentials for an existing mailbox.

Vendor notified: November 24, 2005 10:50AM
Patch released: November 24, 2005 13:28PM

Solution:
Download patch from: http://www.mailenable.com/hotfix/MEIMAPS.ZIP

To install:
1) Stop the IMAP service
2) Rename the MEIMAPS.EXE file in the Mail Enablebin directory as this
will
allow you to roll back this fix
3) Extract the zip file from the URL above to the Mail Enablebin directory
4) Start the IMAP service

References: http://zur.homelinux.com/Advisories/MailEnableImapDos.txt




Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc/fnmatch(3) DoS

Security Risk Medium- 2011-05-13

Allow attacker to denial of service apache 2.2.17 server
Apache RSS Apache Alert

» Apache HTTP Server Denial
   of Service Vulnerability

» Multiple Vendors
   libc/fnmatch(3) DoS (incl
   apache poc)

» Apache Continuum
   cross-site scripting
   vulnerability

» Apache Tomcat DoS
   Vulnerability
PHP RSS PHP Alert

» PHP Hashtables Denial of
   Service

» PHP 5.3.6 multiple null
   pointer dereference

» PHP 5.3.6 ZipArchive
   invalid use glob(3)

» libzip 0.9.3
   _zip_name_locate NULL
   Pointer Dereference (incl
   PHP 5.3.5)
ADT

Protect your family and valuables with Home Security Systems
Copyright © SecurityReason.com. All Rights Reserved.