Secunia

Three vulnerabilities have been discovered in MailEnable Professional, which potentially can be exploited by malicious people to compromise a vulnerable system or cause a DoS (Denial of Service).

1) A boundary error within the HTTPMail service's ("MEHTTPS.EXE") logging functionality can be exploited to cause a stack-based buffer overflow by sending an overly long GET request (about 4032 bytes) to the service. Exploitation of this issue requires that logging is enabled (default setting).

2) Another boundary error within the HTTPMail service when handling incoming data can be exploited to cause a heap overflow by sending an overly long amount of data (about 8501 bytes) to the service.

Successful exploitation of the two vulnerabilities crashes the service and may potentially allow execution of arbitrary code.

3) A NULL pointer dereference error within the HTTPMail service when processing "Authorization:" headers can be exploited to crash the service by passing a malformed string in the header.

The vulnerabilities have been confirmed in version 1.18. Prior versions are reportedly also affected.

Solution
Apply hotfix:
Further details available in Customer Area

Provided and/or discovered by
1+2) Behrang Fouladi, Hat-Squad.
3) Oliver Karow

Changelog
Further details available in Customer Area

Original Advisory
Hat-Squad:
http://www.hat-squad.com/en/000071.html

Oliver Karow:
http://www.oliverkarow.de/research/MailWebHTTPAuthCrash.txt

Deep Links
Links available in Customer Area