Nine:Situations:Group::bruiser has discovered a vulnerability in CMailServer, which can be exploited by malicious users to compromise a vulnerable system.

The vulnerability is caused due to a boundary error in the POP3 Class ActiveX control (CMailCOM.dll) when handling arguments passed to the "MoveToFolder()" method. This can be exploited to cause a stack-based buffer overflow by sending a specially crafted POST request to mvmail.asp with an overly long "indexOfMail" parameter.

Successful exploitation allows execution of arbitrary code.

NOTE: Other methods have also been mentioned as vulnerable and may be exploitable similarly.

The vulnerability is confirmed in version 5.4.6. Other versions may also be affected.

Solution
Grant only trusted users access to the application.

Provided and/or discovered by
Nine:Situations:Group::bruiser

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/6012

Deep Links
Links available in Customer Area