Description
Stack-based buffer overflow in the IMAP service in Mercur Messaging 5.0 SP3 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long string to the (1) LOGIN or (2) SELECT command, a different set of attack vectors and possibly a different vulnerability than CVE-2003-1177.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 2 modules
-
Mercur Messaging 2005 IMAP Login Buffer Overflow
exploit/windows/imap/mercur_login
-
Mercur v5.0 IMAP SP3 SELECT Buffer Overflow
exploit/windows/imap/mercur_imap_select_overflow
Exploit-DB 6
- Mercur MailServer 5.0 - IMAP SP3 SELECT Buffer Overflow (Metasploit) EDB-16476 · remote · Sep 20, 2010 · verified
- Mercur Messaging 2005 - IMAP Login Buffer Overflow (Metasploit) EDB-16481 · remote · Aug 25, 2010 · verified
- Mercur Messaging 2005 < SP4 - IMAP Remote (Egghunter) EDB-3540 · remote · Mar 21, 2007 · verified
- Mercur Messaging 2005 - IMAP Remote Buffer Overflow EDB-3133 · remote · Jan 15, 2007 · verified
- Mercur MailServer 5.0 SP3 - 'IMAP' Remote Buffer Overflow (2) EDB-2345 · remote · Sep 11, 2006 · verified
- Mercur MailServer 5.0 SP3 - 'IMAP' Remote Buffer Overflow (1) EDB-1592 · remote · Mar 19, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- ADV-2006-0977 vdb-entry
- 23950 vdb-entry
- mercur-imap-bo(25290) vdb-entry
- 20060316 Mercur IMAPD 5.0 SP3 DoS Exploit or more? mailing-list
- 20060316 Re: Mercur IMAPD 5.0 SP3 DoS Exploit or more? mailing-list
- 19267 third-party-advisory
- 17138 vdb-entry