1. Skip to navigation
  2. Skip to content
  3. Skip to secondary-content

Where You Are

  1. Home
  2. Security
  3. Security Lab
  4. Latest Threats
  5. Vulnerability Descriptions
  6. SA30940

CMailServer POP3 Class ActiveX Control Buffer Overflow

Report ID: SA30940
Source: Secunia
Date of Discovery: 07.07.2008
Criticality: Moderate
Affects:
CMailServer 5.x
Compromise From: From remote
Compromise Type: System access

Summary

A vulnerability in CMailServer, which can be exploited by attackers to compromise a vulnerable system.

Detailed Description

A vulnerability in CMailServer, which can be exploited by attackers to compromise a vulnerable system.

The vulnerability is caused due to a boundary error in the POP3 Class ActiveX control (CMailCOM.dll) when handling arguments passed to the "MoveToFolder()" method. This can be exploited to cause a stack-based buffer overflow by sending a specially crafted POST request to mvmail.asp with an overly long "indexOfMail" parameter.

Successful exploitation allows execution of arbitrary code.

NOTE: Other methods have also been mentioned as vulnerable and may be exploitable similarly.

The vulnerability is confirmed in version 5.4.6. Other versions may also be affected.

Solution

Grant only trusted users access to the application.