Details of VAR-200703-0303

ID

VAR-200703-0303

CVE

CVE-2007-1637

TITLE

Ipswitch IMail Server of IMAILAPILib ActiveX Control buffer overflow vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2007-003570

DESCRIPTION

Multiple buffer overflows in the IMAILAPILib ActiveX control (IMailAPI.dll) in Ipswitch IMail Server before 2006.2 allow remote attackers to execute arbitrary code via the (1) WebConnect and (2) Connect members in the (a) IMailServer control; (3) Sync3 and (4) Init3 members in the (b) IMailLDAPService control; and the (5) SetReplyTo member in the (c) IMailUserCollection control. A buffer overflow vulnerability exists in the IMAILAPILib ActiveX control (IMailAPI.dll) of Ipswitch IMail Server versions prior to 2006.2. ---------------------------------------------------------------------- Want a new job? http://secunia.com/secunia_vacancies/ Secunia is looking for new researchers with a reversing background and experience in writing exploit code: http://secunia.com/hardcore_disassembler_and_reverse_engineer/ http://secunia.com/Disassembling_og_Reversing/ ---------------------------------------------------------------------- TITLE: Ipswitch IMail Server/Collaboration Suite Multiple Buffer Overflows SECUNIA ADVISORY ID: SA24422 VERIFY ADVISORY: http://secunia.com/advisories/24422/ CRITICAL: Highly critical IMPACT: System access WHERE: >From remote SOFTWARE: Ipswitch Collaboration Suite 2006 http://secunia.com/product/8652/ IMail Server 2006 http://secunia.com/product/8653/ DESCRIPTION: Some vulnerabilities have been reported in Ipswitch IMail Server/Collaboration Suite, which potentially can be exploited by malicious people to compromise a vulnerable system. 1) Unspecified errors within the IMailServer.WebConnect, IMailLDAPService.Sync3, IMailLDAPService.Init3, IMailServer.Connect, and IMailUserCollection.SetReplyTo components can be exploited to cause buffer overflows via specially crafted packets. 2) An error within an unspecified ActiveX control can be exploited to execute arbitrary code when a user e.g. visits a malicious web site. SOLUTION: Update to version 2006.2 (Standard Edition only): ftp://ftp.ipswitch.com/Ipswitch/Product_Downloads/ICS_Standard.exe PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: Ipswitch: http://www.ipswitch.com/support/ics/updates/ics20062.asp http://support.ipswitch.com/kb/IM-20070305-JH01.htm ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.8

sources: NVD: CVE-2007-1637 // JVNDB: JVNDB-2007-003570 // VULHUB: VHN-24999 // PACKETSTORM: 54869

AFFECTED PRODUCTS

vendor:	ipswitch	model:	imail	scope:	eq	version:	2006	Trust: 1.6
vendor:	ipswitch	model:	imail premium	scope:	eq	version:	2006	Trust: 1.6
vendor:	ipswitch	model:	imail plus	scope:	eq	version:	2006	Trust: 1.6
vendor:	ipswitch	model:	collaboration suite	scope:	eq	version:	2006_standard	Trust: 1.6
vendor:	ipswitch	model:	imail	scope:	eq	version:	2006.2	Trust: 0.8
vendor:	ipswitch	model:	imail	scope:	lt	version:	server	Trust: 0.8

sources: JVNDB: JVNDB-2007-003570 // CNNVD: CNNVD-200703-591 // NVD: CVE-2007-1637

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2007-1637
value:	HIGH
Trust: 1.0
NVD:	CVE-2007-1637
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-200703-591
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-24999
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2007-1637
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-24999
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-24999 // JVNDB: JVNDB-2007-003570 // CNNVD: CNNVD-200703-591 // NVD: CVE-2007-1637

PROBLEMTYPE DATA

problemtype:

NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2007-1637

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200703-591

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-200703-591

CONFIGURATIONS

sources: JVNDB: JVNDB-2007-003570

PATCH

title:

IM-20070305-JH01

url:

http://support.ipswitch.com/kb/IM-20070305-JH01.htm

Trust: 0.8

sources: JVNDB: JVNDB-2007-003570

EXTERNAL IDS

db:	NVD	id:	CVE-2007-1637	Trust: 2.5
db:	SECUNIA	id:	24422	Trust: 1.8
db:	SECTRACK	id:	1017737	Trust: 1.7
db:	VUPEN	id:	ADV-2007-0853	Trust: 1.7
db:	JVNDB	id:	JVNDB-2007-003570	Trust: 0.8
db:	CNNVD	id:	CNNVD-200703-591	Trust: 0.7
db:	IDEFENSE	id:	20070307 IPSWITCH IMAIL SERVER 2006 MULTIPLE ACTIVEX CONTROL BUFFER OVERFLOW VULNERABILITIE	Trust: 0.6
db:	BID	id:	83550	Trust: 0.1
db:	VULHUB	id:	VHN-24999	Trust: 0.1
db:	PACKETSTORM	id:	54869	Trust: 0.1

sources: VULHUB: VHN-24999 // JVNDB: JVNDB-2007-003570 // PACKETSTORM: 54869 // CNNVD: CNNVD-200703-591 // NVD: CVE-2007-1637

REFERENCES

url:	http://support.ipswitch.com/kb/im-20070305-jh01.htm	Trust: 1.8
url:	http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=487	Trust: 1.7
url:	http://www.securitytracker.com/id?1017737	Trust: 1.7
url:	http://secunia.com/advisories/24422	Trust: 1.7
url:	http://www.vupen.com/english/advisories/2007/0853	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-1637	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-1637	Trust: 0.8
url:	http://www.frsirt.com/english/advisories/2007/0853	Trust: 0.6
url:	http://secunia.com/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/product/8652/	Trust: 0.1
url:	http://secunia.com/disassembling_og_reversing/	Trust: 0.1
url:	http://www.ipswitch.com/support/ics/updates/ics20062.asp	Trust: 0.1
url:	http://secunia.com/product/8653/	Trust: 0.1
url:	http://secunia.com/secunia_vacancies/	Trust: 0.1
url:	http://secunia.com/hardcore_disassembler_and_reverse_engineer/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/advisories/24422/	Trust: 0.1
url:	http://secunia.com/about_secunia_advisories/	Trust: 0.1

sources: VULHUB: VHN-24999 // JVNDB: JVNDB-2007-003570 // PACKETSTORM: 54869 // CNNVD: CNNVD-200703-591 // NVD: CVE-2007-1637

CREDITS

Secunia

Trust: 0.1

sources: PACKETSTORM: 54869

SOURCES

db:	VULHUB	id:	VHN-24999
db:	JVNDB	id:	JVNDB-2007-003570
db:	PACKETSTORM	id:	54869
db:	CNNVD	id:	CNNVD-200703-591
db:	NVD	id:	CVE-2007-1637

LAST UPDATE DATE

2025-04-10T23:21:02.471000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-24999	date:	2011-03-08T00:00:00
db:	JVNDB	id:	JVNDB-2007-003570	date:	2012-09-25T00:00:00
db:	CNNVD	id:	CNNVD-200703-591	date:	2007-03-27T00:00:00
db:	NVD	id:	CVE-2007-1637	date:	2025-04-09T00:30:58.490

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-24999	date:	2007-03-23T00:00:00
db:	JVNDB	id:	JVNDB-2007-003570	date:	2012-09-25T00:00:00
db:	PACKETSTORM	id:	54869	date:	2007-03-08T00:54:52
db:	CNNVD	id:	CNNVD-200703-591	date:	2007-03-23T00:00:00
db:	NVD	id:	CVE-2007-1637	date:	2007-03-23T22:19:00