hempel has discovered a vulnerability in the AXIGEN Mail Server, which can be exploited by malicious people to cause a DoS (Denial of Service) or to potentially compromise a vulnerable system.

The vulnerability is caused due to a format string error within the AXIMilter module when parsing mail data. This can be exploited by sending specially crafted data containing format string specifiers to the TCP port on which AXIMilter is listening.

NOTE: Similar vulnerabilities reportedly affect the AxigenDK Verifier (axidkd) and the AxigenDK Signer (axidksd).

The vulnerability is confirmed in version 5.0.2. Prior versions may also be affected.

Solution
Update to version 5.0.2 build 2.
Further details available to Secunia VIM customers

Provided and/or discovered by
hempel

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059788.html

Deep Links
Links available to Secunia VIM customers