Two vulnerabilities have been reported in Ipswitch IMail Server, which can be exploited by malicious people to manipulate certain data, cause a DoS (Denial of Service), and potentially compromise a vulnerable system.

1) The TLS implementation does not properly clear the transport layer buffers when upgrading from plaintext to ciphertext after receiving the "STARTTLS" command. This can be exploited to insert arbitrary plaintext data (e.g. SMTP commands) during the plaintext phase, which will then be executed after upgrading to the TLS ciphertext phase.

2) A race condition exists within the TLS extension parsing code.

For more information:
SA42243

Solution
Update to version 11.5.

Provided and/or discovered by
1) Wietse Venema.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Ipswitch:
http://docs.ipswitch.com/_Messaging/IMailServer/v11.5/ReleaseNotes/index.htm

US-CERT VU#555316:
http://www.kb.cert.org/vuls/id/555316
http://www.kb.cert.org/vuls/id/MAPG-8DBRD4

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers