Secunia

Nemesis Security Audit Group has discovered a vulnerability in MDaemon, which potentially can be exploited by malicious users to cause a DoS (Denial of Service).

The vulnerability is caused due to an error in the handling of IMAP mail folder names containing format string specifiers. This can be exploited to cause the service to consume large amount of CPU resources by first creating email folders with format string specifiers in their names and then listing them.

The vulnerability has been confirmed in version 8.1.4 and also reported in version 8.1.1. Other versions may also be affected.

Solution
Update to version 8.15.

Provided and/or discovered by
Nemesis Security Audit Group

Changelog
Further details available in Customer Area

Original Advisory
http://www.nsag.ru/vuln/888.html

Deep Links
Links available in Customer Area