#######################################################################

                             Luigi Auriemma

Application:  MailEnable Professional and Enterprise
              http://www.mailenable.com
Versions:     <= 3.13
Platforms:    Windows
Bugs:         A] multiple post-auth buffer-overflows
              B] NULL pointers
Exploitation: remote, versus the IMAP service
Date:         07 Mar 2008
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


MailEnable is a mail server for Windows which supports various
protocols like SMTP, POP3, IMAP, webmail and a HTTPMail service.


#######################################################################

=======
2) Bugs
=======

--------------------------------------
A] multiple post-auth buffer-overflows
--------------------------------------

The IMAP service (MEIMAPS.exe) of MailEnable is affected by some
buffer-overflow vulnerabilities caused by too long parameters passed
to the FETCH, EXAMINE and UNSUBSCRIBE commands allowing an attacker to
execute malicious code.

All the vulnerable commands require an account to be exploited.


----------------
B] NULL pointers
----------------

The IMAP service is affected also by two NULL pointer vulnerabilities
exploitable through the omission of the required arguments for the
SEARCH and APPEND commands, where the first can be used by
unauthenticated attackers too.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/maildisable.zip


#######################################################################

======
4) Fix
======


No fix


#######################################################################


--- 
Luigi Auriemma
http://aluigi.org