Summary
The remote web server is affected by a buffer overflow vulnerability.
Description :
The target is running at least one instance of MailEnable that has a flaw in the HTTPMail service (MEHTTPS.exe) in the Professional and Enterprise Editions. The flaw can be exploited by issuing an HTTP GET with an Content-Length header exceeding 100 bytes, which causes a fixed-length buffer to overflow, crashing the HTTPMail service and possibly allowing for arbitrary code execution.
Solution
Upgrade to MailEnable Professional / Enterprise 1.2 or later or apply the HTTPMail hotfix from 9th August 2004 found at
http://www.mailenable.com/hotfix/
References
Updated on 2015-03-25
Severity
Classification
-
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities
- Apache Struts ClassLoader Manipulation Vulnerabilities
- A Really Simple Chat Multiple SQL Injection Vulnerabilities
- Apache Struts2 Showcase Skill Name Remote Code Execution Vulnerability
- Atlassian JIRA Privilege Escalation and Multiple Cross Site Scripting Vulnerabilities
- AjaXplorer zoho plugin Directory Traversal Vulnerability