Dr_insane has reported some vulnerabilities in @Mail, which can be exploited by malicious people to conduct cross-site scripting attacks and cause a DoS (Denial of Service).

1) Input supplied in the "Displayed Name" field in "util.pl?func=settings" is not sanitised sufficiently, which can be exploited to execute arbitrary script code in a user's browser session in context of an affected site.

2) The "folder" parameter in "showmail.pl" can also be exploited to conduct cross-site scripting attacks due to missing input validation. This is the same vulnerability as issue #4 in the following advisory reported by Nick Gudov in an earlier version:
SA10397

3) An error in the POP3 service's connection handling can reportedly be exploited to cause a DoS by establishing about 600 connections to it.

The vulnerabilities have been reported in version 3.64. Other versions may also be affected.

Solution
Filter malicious characters and character sequences in a proxy. Restrict access to the POP3 service, allowing only trusted IP addresses to connect.

Provided and/or discovered by
Dr_insane

Original Advisory
http://members.lycos.co.uk/r34ct/main/@mail_3.64/@mail_3.64.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area