Secunia

Three vulnerabilities have been identified in BaSoMail Server allowing local users to read usernames and passwords in clear text and malicious people to cause a Denial of Service.

The file containing information about valid account names and passwords is stored in an insecure directory and all contents of the file is in clear text. This allows malicious local users to view the data.

Malicious users may crash BaSoMail Server by authenticating with the POP3 service and supply negative values for "LIST" and "DELE" commands and then close the connection with a "QUIT".

Malicious people may connect to the SMTP service and send more than 2100 characters as an argument to "HELO", "Mail From" or "Rcpt to", after doing this 7-8 times the BaSoMail Server will crash.

Version 1.24 has been reported to be vulnerable.

Solution
We are not aware of any updates.
Further details available in Customer Area

Provided and/or discovered by
Ziv Kamir

Deep Links
Links available in Customer Area