Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (E-mail Server)  >   MailEnable Vendors:   MailEnable Pty. Ltd.
MailEnable IMAP RENAME Command Lets Remote Authenticated Users Deny Service
SecurityTracker Alert ID:  1015268
SecurityTracker URL:
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Nov 24 2005
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): MailEnable Pro 1.7; MailEnable Enterprise 1.1
Description:   A vulnerability was reported in MailEnable. A remote authenticated user can cause denial of service conditions.

A remote authenticated user can send a specially crafted IMAP RENAME request with a non-existent mailbox name to cause the target IMAP service to crash.

A demonstration exploit transcript is provided:

telnet localhost 143
a1 login josh byebye
a2 rename foo bar

The vendor was notified on November 24, 2005.

Josh Zlatin-Amishav reported this vulnerability.

The original advisory is available at:

Impact:   A remote authenticated user can cause the target IMAP service to crash.
Solution:   The vendor has issued a fix:

Vendor URL: (Links to External Site)
Cause:   Exception handling error
Underlying OS:  Windows (NT), Windows (2000), Windows (2003), Windows (XP)

Message History:   None.

 Source Message Contents

Subject:  [Full-disclosure] MailEnable IMAP DOS

Synopsis: MailEnable Imap Remote DOS.

Product: MailEnable Pro
          MailEnable Enterprise

Version: Confirmed on MailEnable Pro 1.7 and MailEnable Enterprise 1.1

Author: Josh Zlatin-Amishav

Date: November 24, 2005

MailEnable's mail server software provides a powerful, scalable hosted 
messaging platform for Microsoft Windows. MailEnable offers stability, 
unsurpassed flexibility and an extensive feature set which allows you to 
provide cost-effective mail services.

In working with researchers at Tenable Network Security, I have come across
a Denial of Service attack in the MailEnable Pro and MailEnable Enterprise
IMAP server. It is possible to remotely crash the IMAP server by sending a 
rename request with non existant mailbox names

telnet localhost 143
a1 login josh byebye
a2 rename foo bar

where josh and byebye are the login credentials for an existing mailbox.

Vendor notified: November 24, 2005 10:50AM
Patch released:  November 24, 2005 13:28PM

Download patch from:

To install:
1) Stop the IMAP service
2) Rename the MEIMAPS.EXE file in the Mail Enable\bin directory as this will
    allow you to roll back this fix
3) Extract the zip file from the URL above to the Mail Enable\bin directory
4) Start the IMAP service

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC