Secunia

Two vulnerabilities have been reported in MailEnable, which can be exploited by malicious people to cause a DoS (Denial of Service) and to compromise a vulnerable system.

1) A boundary error exists within the handling of certain POP3 pre-authentication command. This can be exploited to cause a buffer overflow and allows execution of arbitrary code.

2) An error exists within the webmail component when handling encoded quoted-printable emails. This can potentially be exploited to consume a large amount of CPU resources when a malformed quoted-printable email is viewed.

Note: A bug in the cryptographic implementation that weakened authentication security has also been reported.

The vulnerabilities have been reported in some or all of the following products:
* MailEnable Standard Edition versions 1.91, and 1.92.
* MailEnable Professional Edition version 1.72 and prior.
* MailEnable Enterprise Edition 1.2

Solution
Apply hotfix ME-10012 or update to the fixed versions.
Further details available in Customer Area

Provided and/or discovered by
1) Mu Security
2) Reported by vendor.

Changelog
Further details available in Customer Area

Original Advisory
Mu Security:
http://www.musecurity.com/MU-200603-01.txt

MailEnable:
http://www.mailenable.com/standardhistory.asp
http://www.mailenable.com/professionalhistory.asp
http://www.mailenable.com/enterprisehistory.asp

Deep Links
Links available in Customer Area