A remote overflow exists in IMail Server. The IMAP service (IMAP4D32.EXE) fails to perform proper bounds checking resulting in a buffer overflow. By passing either an overly long username starting with special characters to the 'LOGIN' command, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.

Upgrade to version 8.2 Hotfix 2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1014047
• Milw0rm: 1035 1124
• Exploit Database: 1035 1124
• Secunia Advisory ID: 15483
• Related OSVDB ID: 16803 16805 16806 16807
• CVE ID: 2005-1255 (see also: NVD)
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-05/0274.html
  http://archives.neohapsis.com/archives/fulldisclosure/2005-06/0075.html
• Generic Exploit URL: http://immunitysec.com
  http://www.saintcorporation.com/cgi-bin/exploit_info/imail_imap_login_specialchar
  http://www.securiteam.com/exploits/5ZP0E00GLA.html
• Other Advisory URL: http://www.idefense.com/application/poi/display?id=243&type=vulnerabilities
• Vendor URL: http://www.ipswitch.com/products/collaboration/index.asp
  http://www.ipswitch.com/products/IMail_Server/index.html
• Vendor Specific Advisory URL: http://www.ipswitch.com/support/imail/releases/imail_professional/im82hf2.html

• Anonymous - iDefense Labs VCP
• iDefense Labs - iDefense Labs