Ipswitch IMail serverpost attachment imailsrv.exe Stack Overflow Vulnerability and repair

Affected Versions:

Ipswitch IMail 11.01

Vulnerability description:

Bugtraq id: 41719 Ipswitch IMail Server is a bound email Server in the Ipswitch Collaboration component. The imailsrv.exe process is used to process messages sent to imailsrv. If the message title contains "? Q ?" The string after the sequence is copied to the local stack buffer without the length check, resulting in arbitrary code execution. If you want to reach this code path, the email list must be password protected (authentication required), or you have already configured a password (authentication not required ).

<* Reference

ZDI ( Http://www.zerodayinitiative.com/)

Http://marc.info /? L = full-disclosure & m = 127922156216490 & w = 2

*>

Vendor patch: Ipswitch -------- the current vendor has released the upgrade patch to fix this security problem, please go to the vendor's home page download: http://www.ipswitch.com/