CVE-2006-5177

MailEnable Professional/E 2.0 - RCE/DoS

Title source: llm

Description

The NTLM authentication in MailEnable Professional 2.0 and Enterprise 2.0 allows remote attackers to (1) execute arbitrary code via unspecified vectors involving crafted base64 encoded NTLM Type 3 messages, or (2) cause a denial of service via crafted base64 encoded NTLM Type 1 messages, which trigger a buffer over-read.

Exploits (1)

exploitdb WORKING POC VERIFIED

by mu-b · perldoswindows

https://www.exploit-db.com/exploits/28735

View Code ZIP pw:eip

References (7)

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/29287

[Patch, Vendor Advisory] http://secunia.com/advisories/22179

[Patch] http://www.mailenable.com/hotfix/

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/29286

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/20290

[Third Party Advisory] http://www.vupen.com/english/advisories/2006/3862

[Patch, Vendor Advisory] http://labs.musecurity.com/advisories/MU-200609-01.txt

Scores

EPSS 0.0541

EPSS Percentile 90.2%

Details

CWE

CWE-119

Status published

Products (2)

mailenable/mailenable_enterprise 2.0

mailenable/mailenable_professional 2.0

Published Oct 10, 2006

Tracked Since Feb 18, 2026