Two vulnerabilities have been discovered in Internet Anywhere (IA) eMailServer, which can be exploited by malicious users and by malicious people to cause a DoS (Denial of Service).

1) An error exists within the handling of the IMAP SEARCH command. This can be exploited by authenticated users to crash the service via an overly long parameter passed to the command.

2) An error exists within the handling of the IMAP LOGIN command. This can be exploited to crash the service prior to authentication via specially-crafted parameters passed to the command.

The vulnerabilities have been confirmed in version 5.3.4 Build 2019. Other versions may also be affected.

Solution
Filter potentially malicious IMAP requests using a firewall.
Further details available in Customer Area

Provided and/or discovered by
1) Joao Antunes
2) Evgeny Legerov

Changelog
Further details available in Customer Area

Original Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/043567.html

Deep Links
Links available in Customer Area