| CVE-2008-1277 |
|
发布时间 :2008-03-10 19:44:00 | ||
| 修订时间 :2011-03-07 22:06:26 | ||||
| NMCO |
[原文]The IMAP service (MEIMAPS.exe) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allows remote attackers to cause a denial of service (crash) via (1) SEARCH and (2) APPEND commands without required arguments, which triggers a NULL pointer dereference.
[CNNVD]MailEnable IMAP服务拒绝服务漏洞(CNNVD-200803-154)
MailEnable是一款商业性质的POP3和SMTP服务器。
MailEnable Professional Edition 和 Enterprise Edition 3.13 及其早期版本中的IMAP服务(MEIMAPS.exe)会允许远程攻击者通过(1) SEARCH 和 (2) 可以造成一个NULL指示器解除参照的不含必须变量的APPEND 命令，来造成一个拒绝服务(崩溃)。
–
CVSS (基础分值)
| CVSS分值: | 9 | [严重(HIGH)] |
| 机密性影响: | COMPLETE | [完全的信息泄露导致所有系统文件暴露] |
| 完整性影响: | COMPLETE | [系统完整性可被完全破坏] |
| 可用性影响: | COMPLETE | [可能导致系统完全宕机] |
| 攻击复杂度: | LOW | [漏洞利用没有访问限制 ] |
| 攻击向量: | NETWORK | [攻击者不需要获取内网访问权或本地访问权] |
| 身份认证: | SINGLE_INSTANCE | [–] |
–
CWE (弱点类目)
| CWE-20 | [输入验证不恰当] |
–
CPE (受影响的平台与产品)
| cpe:/a:mailenable:mailenable_professional:3.13 | |
| cpe:/a:mailenable:mailenable_enterprise:3.13 |
–
OVAL (用于检测的技术细节)
| 未找到相关OVAL定义 |
–
官方数据库链接
–
其它链接及资源
|
http://xforce.iss.net/xforce/xfdb/41059 (UNKNOWN) XF mailenable-imapservice-dos(41059) |
|
http://www.vupen.com/english/advisories/2008/0799/references (UNKNOWN) VUPEN ADV-2008-0799 |
|
http://www.securitytracker.com/id?1019565 (UNKNOWN) SECTRACK 1019565 |
|
http://www.securityfocus.com/bid/28145 (UNKNOWN) BID 28145 |
|
http://www.securityfocus.com/archive/1/archive/1/489270/100/0/threaded (UNKNOWN) BUGTRAQ 20080307 Multiple vulnerabilities in MailEnable Professional/Enterprise 3.13 |
|
http://securityreason.com/securityalert/3724 (UNKNOWN) SREASON 3724 |
|
http://secunia.com/advisories/29277 (VENDOR_ADVISORY) SECUNIA 29277 |
|
http://aluigi.altervista.org/adv/maildisable-adv.txt (UNKNOWN) MISC http://aluigi.altervista.org/adv/maildisable-adv.txt |
–
漏洞信息
| MailEnable IMAP服务拒绝服务漏洞 | |
| 高危 | 输入验证 |
| 2008-03-10 00:00:00 | 2008-09-05 00:00:00 |
| 远程 | |
| MailEnable是一款商业性质的POP3和SMTP服务器。 MailEnable Professional Edition 和 Enterprise Edition 3.13 及其早期版本中的IMAP服务(MEIMAPS.exe)会允许远程攻击者通过(1) SEARCH 和 (2) 可以造成一个NULL指示器解除参照的不含必须变量的APPEND 命令，来造成一个拒绝服务(崩溃)。 |
|
–
公告与补丁
|
目前厂商还没有提供补丁或者升级程序，建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.mailenable.com/ |
–
漏洞信息
42740 |
|
| MailEnable IMAP Service (MEIMAPS.EXE) Multiple Commands Remote Overflow DoS | |
Remote / Network Access |
Denial of Service, Input Manipulation |
| Loss of Integrity, Loss of Availability |
Patch / RCS |
| Vendor Verified | |
–
漏洞描述
–
时间线
2008-03-07 |
Unknow |
| Unknow | Unknow |
–
解决方案
| Currently, there are no known workarounds or upgrades to correct this issue. However, MailEnable has released a patch to address this vulnerability. |
–
相关参考
|
–
漏洞作者
| Unknown or Incomplete |
![[八卦] 王婷婷—揭秘一个大三女生的性爱录像-微慑信息网-VulSee.com](http://free.86hy.com/crack/pic/1.jpg)
![[随笔]今天国际警察节-微慑信息网-VulSee.com](http://photo.sohu.com/20041017/Img222528326.jpg)
青云网
