rgod has reported a vulnerability in Hexamail Server, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially to compromise a vulnerable system.

The vulnerability is caused due to a boundary error within pop3server when processing POP3 "USER" commands. This can be exploited to cause a heap-based buffer overflow by sending a "USER" command with an overly long parameter to the affected server.

Successful exploitation may allow execution of arbitrary code.

The vulnerability is reported in version 3.0.0.001. Prior versions may also be affected.

Solution
Update to 3.0.1.004.

Provided and/or discovered by
rgod

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://retrogod.altervista.org/hexamail_bof.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers