Summary
The remote web server is affected by a buffer overflow vulnerability.
Description :
The target is running at least one instance of MailEnable that has a flaw in the HTTPMail service (MEHTTPS.exe) in the Professional and Enterprise Editions. The flaw can be exploited by issuing an HTTP GET with an Content-Length header exceeding 100 bytes, which causes a fixed-length buffer to overflow, crashing the HTTPMail service and possibly allowing for arbitrary code execution.
Solution
Upgrade to MailEnable Professional / Enterprise 1.2 or later or apply the HTTPMail hotfix from 9th August 2004 found at
http://www.mailenable.com/hotfix/
References
Updated on 2015-03-25
Severity
Classification
-
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities
- ASAS Server End User Self Service (EUSS) SQL Injection Vulnerability
- Andy's PHP Knowledgebase 's' Parameter SQL Injection Vulnerability
- Awstats Configuration File Remote Arbitrary Command Execution Vulnerability
- Apache Struts2 Redirection and Security Bypass Vulnerabilities
- ASUS RT56U Router Multiple Vulnerabilities