[Full-disclosure] Kerio MailServer bugfun

Hi, It should be noted that ProtoVer Sample IMAP testsuite has been released with 3 unpublished bugs. Now it looks like that Kerio MailServer preauth bug has been fixed. Kerio MailServer 6.1.3 changelog: """ Version 6.1.3 Patch 1 - March 9, 2006 - Fixed possible crash when handling special crafte...

Kerio MailServer IMAP mail server DoS

Crash on IMAP Login command like a001 LOGIN 4294967294...

IPSwitch IMail IMAP mail server DoS

FETCH IMAP command processing DoS and code execution...

[Full-disclosure] ZDI-06-003: Ipswitch Collaboration Suite Code Execution Vulnerability

ZDI-06-003: Ipswitch Collaboration Suite Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-06-003.html March 13, 2006 -- CVE ID: CVE-2005-3526 -- Affected Vendor: Ipswitch -- Affected Products: Ipswitch Collaboration Suite 2006.02 and below -- TippingPointTM IPS Custome...

Ipswitch Collaboration Suite Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Ipswitch Collaboration Suite. Authentication is required to exploit this vulnerability. This specific flaw exists within the IMAP daemon. A lack of bounds checking during the parsing of long...

Ipswitch Multiple Products < 2006.03 IMAP FETCH Command Overflow

Binary data 3473.prm...

Kerio MailServer IMAP Server Crafted LOGIN Command DoS

The remote host is running Kerio MailServer, a commercial mail server available for Windows, Linux, and Mac OS X platforms. The installed version of Kerio MailServer terminates abnormally when it receives certain malformed IMAP LOGIN commands. An unauthenticated, remote attacker can exploit this...

Ipswitch IMail Server/Collaboration Suite IMAP FETCH Command Overflow

The remote host is running Ipswitch Collaboration Suite / IMail Secure Server / IMail Server, commercial messaging and collaboration suites for Windows. According to its banner, the version of Ipswitch Collaboration Suite / IMail Secure Server / IMail Server installed on the remote host has a...

GLSA-200603-09 : SquirrelMail: XSS and IMAP command injection

The remote host is affected by the vulnerability described in GLSA-200603-09 SquirrelMail: XSS and IMAP command injection SquirrelMail does not validate the rightframe parameter in webmail.php, possibly allowing frame replacement or cross-site scripting CVE-2006-0188. Martijn Brinkers and Scott...

Command injection

Kerio MailServer before 6.1.3 Patch 1 allows remote attackers to cause a denial of service application crash via a crafted IMAP LOGIN command...

CVE-2006-1158

Kerio MailServer before 6.1.3 Patch 1 allows remote attackers to cause a denial of service application crash via a crafted IMAP LOGIN command...

CVE-2006-1158

CVE-2006-1158 affects Kerio MailServer prior to 6.1.3 Patch 1. An unauthenticated remote attacker can trigger a denial of service (application crash) by sending a crafted IMAP LOGIN command. The issue is caused by handling of certain malformed IMAP LOGIN inputs, leading to service disruption. Pub...

CVE-2006-1158

Kerio MailServer before 6.1.3 Patch 1 allows remote attackers to cause a denial of service application crash via a crafted IMAP LOGIN command...

SquirrelMail: Cross-site scripting and IMAP command injection

Background SquirrelMail is a webmail package written in PHP. It supports IMAP and SMTP protocols. Description SquirrelMail does not validate the rightframe parameter in webmail.php, possibly allowing frame replacement or cross-site scripting CVE-2006-0188. Martijn Brinkers and Scott Hughes...

[SA19168] Ipswitch IMail Server/Collaboration Suite IMAP FETCH Vulnerability

TITLE: Ipswitch IMail Server/Collaboration Suite IMAP FETCH Vulnerability SECUNIA ADVISORY ID: SA19168 VERIFY ADVISORY: http://secunia.com/advisories/19168/ CRITICAL: Less critical IMPACT: DoS WHERE: From remote SOFTWARE: IMail Secure Server 2006 http://secunia.com/product/8651/ IMail Server 2006...

[SECURITY] [DSA 988-1] New squirrelmail packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 988-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 8th, 2006 http://www.debian.org/security/faq -...

DSA-988-1 squirrelmail - several

Bulletin has no description...

Design/Logic Flaw

The c-client library 2000, 2001, or 2004 for PHP before 4.4.4 and 5.x before 5.1.5 do not check the 1 safemode or 2 openbasedir functions, and when used in applications that accept user-controlled input for the mailbox argument to the imapopen function, allow remote attackers to obtain access to ...

CVE-2006-1017

The c-client library 2000, 2001, or 2004 for PHP before 4.4.4 and 5.x before 5.1.5 do not check the 1 safemode or 2 openbasedir functions, and when used in applications that accept user-controlled input for the mailbox argument to the imapopen function, allow remote attackers to obtain access to ...

CVE-2006-1017

The c-client library 2000, 2001, or 2004 for PHP before 4.4.4 and 5.x before 5.1.5 do not check the 1 safemode or 2 openbasedir functions, and when used in applications that accept user-controlled input for the mailbox argument to the imapopen function, allow remote attackers to obtain access to ...