Ipswitch Collaboration Suite IMAP FETCH buffer overflow
| ipswitch-imap-fetch-bo (25133) |  High Risk |
Description:
Ipswitch IMail Server is vulnerable to a buffer overflow in the IMAP server. By sending an overly long FETCH command to the IMAP server, a remote attacker with valid authentication credentials could overflow a buffer and cause the service to crash or execute arbitrary code on the system with elevated privileges.
Consequences:
Gain Access
Remedy:
For Ipswitch Collaboration Suite 2006 Premium Edition:
Upgrade to the latest version of Ipswitch Collaboration Suite 2006 Premium Edition (2006.03 or later) available from the Ipswitch Web site. See References.
For Ipswitch Collaboration Suite 2006 Standard Edition:
Upgrade to the latest version of Ipswitch Collaboration Suite 2006 Standard Edition (2006.03 or later) available from the Ipswitch Web site. See References.
For IMail Secure Server 2006:
Upgrade to the latest version of IMail Secure Server 2006 (2006.03 or later) available from the Ipswitch Web site. See References.
For IMail Server 2006:
Upgrade to the latest version of IMail Server 2006 (2006.03 or later) available from the Ipswitch Web site. See References.
References:
- Full-Disclosure Mailing List, Mon Mar 13 2006 - 12:15:23 CST: ZDI-06-003: Ipswitch Collaboration Suite Code Execution Vulnerability.
- IMail Secure Server Web site: Ipswitch, Inc. - IMail Server 2006.
- Imail Server Web site: Ipswitch, Inc. - Purchase IMail 2006.
- Ipswitch Collaboration Suite Web site: Ipswitch, Inc. - Ipswitch Collaboration Suite 2006.
- Ipswitch Update Advisory Released March 9, 2006: IMail Server 2006.03.
- Ipswitch Update Advisory Released March 9, 2006: IMail Secure Server 2006.03.
- Ipswitch Update Advisory Released March 9, 2006: Ipswitch Collaboration Suite 2006.03 Premium Edition.
- Ipswitch Update Advisory Released March 9, 2006: Ipswitch Collaboration Suite 2006.03 Standard Edition.
- ZDI-06-003: Ipswitch Collaboration Suite Code Execution Vulnerability.
- BID-17063: Ipswitch IMail Server / Collaboration Suite IMAP FETCH Remote Buffer Overflow Vulnerability
- CVE-2005-3526: Buffer overflow in the IMAP daemon in Ipswitch Collaboration Suite 2006.02 and earlier allows remote authenticated users to execute arbitrary code via a long FETCH command.
- OSVDB ID: 23796: Ipswitch IMail Server/Collaboration Suite IMAP FETCH Command Overflow
- SA19168: Ipswitch IMail Server/Collaboration Suite IMAP FETCH Vulnerability
- SECTRACK ID: 1015759: Ipswitch Collaboration Suite Buffer Overflow in IMAP FETCH Command Lets Remote Authenticated Users Execute Arbitrary Code
- VUPEN/ADV-2006-0907: Ipswitch Products IMAP FETCH Command Remote Buffer Overflow Vulnerability
Platforms Affected:
- Ipswitch IMail Secure Server prior to 2006.03
- Ipswitch Imail Server 2006
- Ipswitch Ipswitch Collaboration Suite Premium prior to 2006.03
- Ipswitch Ipswitch Collaboration Suite Standard prior to 2006.03
- Microsoft Windows 2003 Server
Reported:
Mar 10, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net