The host is running Ipswitch IMail Server and is prone to plaintext command injection vulnerability.

Successful exploitation will allow attacker to execute arbitrary commands in the context of the user running the application. Impact Level: Application

Upgrade to Ipswitch IMail version 11.5 or later. For updates refer to http://www.imailserver.com/

This flaw is caused by an error within the 'STARTTLS' implementation where the switch from plaintext to TLS is implemented below the application's I/O buffering layer, which could allow attackers to inject commands during the plaintext phase of the protocol via man-in-the-middle attacks.

Ipswitch IMail versions 11.03 and Prior.

• http://secunia.com/advisories/43676
• http://www.vupen.com/english/advisories/2011/060

---

Updated on 2015-03-25