Security Vulnerabilities: NetMail Buffer Overrun and Denial of Service

  • Document ID:3717068
  • Creation Date:22-Dec-2006
  • Modified Date:16-Mar-2012

Environment

Novell NetMail 3.52

Situation

Existing version of NetMail 3.52 can be vulnerable to attack when the following buffers are overrun.
IMAPD subscribe Buffer
The vulnerability could allow remote execution of code on the server running NetMail.
 
Existing version of NetMail 3.52 can be also vulnerable to:
IMAP Denial of Service Issue.
This vulnerability is limited to a Dos only condition and requires authentication in order to exploit it.
 
 

Resolution

This problem is resolved by applying NetMail 3.52e ftf 2

Status

Reported to Engineering
Security Alert

Additional Information

Novell would like to thank Dennis Rand of CIRT.DK working with iDEFENSE (www.idefense.com) for reporting the following issues.
 
[IDEF1651] Novell NetMail IMAPD subscribe Buffer Overflow Vulnerability.
[IDEF1792] Novell Netmail IMAP Denial of Service Vulnerability