CVE-2010-2580

MailEnable < 4.25 - Denial of Service via Long SMTP Command Parameters

Title source: llm

Description

The SMTP service (MESMTPC.exe) in MailEnable 3.x and 4.25 does not properly perform a length check, which allows remote attackers to cause a denial of service (crash) via a long (1) email address in the MAIL FROM command, or (2) domain name in the RCPT TO command, which triggers an "unhandled invalid parameter error."

References (9)

Core 9

Core References

Various Sources x_refsource_confirm

http://www.mailenable.com/Standard-ReleaseNotes.txt

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1024427

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/43182

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/513648/100/0/threaded

Various Sources x_refsource_confirm

http://www.mailenable.com/Professional-ReleaseNotes.txt

Patch, Vendor Advisory x_refsource_confirm

http://www.mailenable.com/hotfix/

Vendor Advisory x_refsource_misc

http://secunia.com/secunia_research/2010-112/

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/41175

Various Sources x_refsource_confirm

http://www.mailenable.com/Enterprise-ReleaseNotes.txt

Scores

EPSS 0.0384

EPSS Percentile 88.9%

Details

CWE

CWE-20

Status published

Products (27)

mailenable/mailenable 4.0 (3 CPE variants)

mailenable/mailenable 4.1 (3 CPE variants)

mailenable/mailenable 4.01 (3 CPE variants)

mailenable/mailenable 4.11 (2 CPE variants)

mailenable/mailenable 4.12 (2 CPE variants)

mailenable/mailenable 4.13 (3 CPE variants)

mailenable/mailenable 4.14 (3 CPE variants)

mailenable/mailenable 4.15 (2 CPE variants)

mailenable/mailenable 4.16 (3 CPE variants)

mailenable/mailenable 4.17 (3 CPE variants)

... and 17 more

Published Sep 15, 2010

Tracked Since Feb 18, 2026