CVE-2006-1255

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• Mercur Messaging 2005 - IMAP Login Buffer Overflow (Metasploit)2010-08-25 · remote · windows · Verified
• Mercur MailServer 5.0 - IMAP SP3 SELECT Buffer Overflow (Metasploit)2010-09-20 · remote · windows · Verified
• Mercur Messaging 2005 < SP4 - IMAP Remote (Egghunter)2007-03-21 · remote · windows · Verified
• Mercur Messaging 2005 - IMAP Remote Buffer Overflow2007-01-15 · remote · windows · Verified
• Mercur MailServer 5.0 SP3 - 'IMAP' Remote Buffer Overflow (2)2006-09-11 · remote · windows · Verified
• Mercur MailServer 5.0 SP3 - 'IMAP' Remote Buffer Overflow (1)2006-03-19 · remote · windows · Verified

Impact

Stack-based buffer overflow in the IMAP service in Mercur Messaging 5.0 SP3 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long string to the (1) LOGIN or (2) SELECT command, a different set of attack vectors and possibly a different vulnerability than CVE-2003-1177.

Affected products

References

• NVD record
• CVE.org record
• http://seclists.org/fulldisclosure/2006/Mar/1111
• http://seclists.org/fulldisclosure/2006/Mar/1167
• http://secunia.com/advisories/19267
• http://www.osvdb.org/23950
• http://www.securityfocus.com/bid/17138
• http://www.vupen.com/english/advisories/2006/0977
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25290
• http://seclists.org/fulldisclosure/2006/Mar/1111
• http://seclists.org/fulldisclosure/2006/Mar/1167
• http://secunia.com/advisories/19267
• http://www.osvdb.org/23950
• http://www.securityfocus.com/bid/17138
• http://www.vupen.com/english/advisories/2006/0977
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25290