----------------------------------------------------------------------

Bist Du interessiert an einem neuen Job in IT-Sicherheit?


Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-
Sicherheit:
http://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
IMail Server Multiple Unspecified Vulnerabilities

SECUNIA ADVISORY ID:
SA15483

VERIFY ADVISORY:
http://secunia.com/advisories/15483/

CRITICAL:
Moderately critical

IMPACT:
Exposure of system information, Exposure of sensitive information,
DoS

WHERE:
>From remote

SOFTWARE:
IMail Server 8.x
http://secunia.com/product/3048/

DESCRIPTION:
Multiple vulnerabilities have been reported in IMail Server, which
can be exploited to gain knowledge of sensitive information or cause
a DoS (Denial of Service).

1) An unspecified error in the IMAP4d32 service can be exploited to
crash the service via a malicious LSUB command.

2) An unspecified error in the IMAP4d32 service can be exploited to
crash the service via a SELECT command with an overly long mailbox
name.

3) An unspecified error in the IMAP4D32 service can be exploited to
crash the service via a LOGIN command with an overly long userid.

4) An unspecified error in the IMAP4D32 service can be exploited to
crash the service via a STATUS command with an overly long mailbox
name.

5) An input validation error in Web Calendaring can be exploited by
malicious users to read arbitrary files on the system via directory
traversal attacks.

SOLUTION:
Apply IMail Server 8.2 Hotfix 2:
ftp://ftp.ipswitch.com/Ipswitch/Product_Support/IMail/imail82hf2.exe

PROVIDED AND/OR DISCOVERED BY:
Reported by vendor.

ORIGINAL ADVISORY:
Ipswitch:
http://www.ipswitch.com/support/imail/releases/imail_professional/im82hf2.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------