Description
Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via long arguments to the (1) EXAMINE, (2) SUBSCRIBE, (3) STATUS, (4) APPEND, (5) CHECK, (6) CLOSE, (7) EXPUNGE, (8) FETCH, (9) RENAME, (10) DELETE, (11) LIST, (12) SEARCH, (13) CREATE, or (14) UNSUBSCRIBE commands.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Mercury/32 v4.01a IMAP RENAME Buffer Overflow
exploit/windows/imap/mercury_rename
Exploit-DB 7
- Mercury/32 Mail Server 4.01a - IMAP RENAME Buffer Overflow (Metasploit) EDB-16484 · remote · May 9, 2010 · verified
- Mercury/32 Mail Server 3.32 < 4.51 - SMTP EIP Overwrite EDB-4316 · remote · Aug 26, 2007 · verified
- Mercury/32 Mail Server 4.0.1 - 'LOGIN' Remote IMAP Stack Buffer Overflow EDB-3561 · remote · Mar 24, 2007 · verified
- Mercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (2) EDB-670 · remote · Dec 1, 2004 · verified
- Mercury/32 Mail Server 4.01a - 'check' Buffer Overflow EDB-1159 · dos · Dec 1, 2004 · verified
- Mercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (1) EDB-668 · remote · Nov 30, 2004 · verified
- Mercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (3) EDB-663 · remote · Nov 29, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://home.kabelfoon.nl/~jaabogae/han/m_401b.html
- 13348 third-party-advisory
- 20041201 Multiple buffer overflows exist in Mercury/32, v4.01a, Dec 8 2003. mailing-list
- 11775 vdb-entry
- 20041201 Multiple buffer overflows exist in Mercury/32, v4.01a, Dec 8 2003. mailing-list
- mercury-command-bo(18318) vdb-entry
- 12508 vdb-entry