CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS
Percentile
99.9%
The remote host is running Ipswitch IMail, a commercial messaging and collaboration suite for Windows.
According to its banner, the version of Ipswitch IMail installed on the remote host has several buffer overflows in its IMAP service component, one of which can be exploited prior to authentication to execute arbitrary code with SYSTEM privileges.
In addition, there is also a denial of service issue that can cause the IM Server to crash without authentication.
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(25737);
script_version("1.27");
script_set_attribute(attribute:"plugin_modification_date", value:"2022/04/11");
script_cve_id(
"CVE-2007-2795",
"CVE-2007-3925",
"CVE-2007-3926",
"CVE-2007-3927"
);
script_bugtraq_id(24962);
script_name(english:"Ipswitch IMail Server < 2006.21 Multiple Vulnerabilities");
script_set_attribute(attribute:"synopsis", value:
"The remote mail server is affected by multiple vulnerabilities.");
script_set_attribute(attribute:"description", value:
"The remote host is running Ipswitch IMail, a commercial messaging and
collaboration suite for Windows.
According to its banner, the version of Ipswitch IMail installed on
the remote host has several buffer overflows in its IMAP service
component, one of which can be exploited prior to authentication to
execute arbitrary code with SYSTEM privileges.
In addition, there is also a denial of service issue that can cause
the IM Server to crash without authentication.");
# https://labs.idefense.com/verisign/intelligence/2009/vulnerabilities/display.php?id=563
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?194eb0fd");
script_set_attribute(attribute:"see_also", value:"https://www.securityfocus.com/archive/1/474040/30/0/threaded");
script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-07-042/");
script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-07-043/");
script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2007/Jul/275");
script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2007/Jul/277");
script_set_attribute(attribute:"see_also", value:"http://www.ipswitch.com/support/imail/releases/im200621.asp");
script_set_attribute(attribute:"solution", value:
"Upgrade to Ipswitch IMail version 2006.21 or later.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"exploit_framework_core", value:"true");
script_set_attribute(attribute:"metasploit_name", value:'Ipswitch IMail IMAP SEARCH Buffer Overflow');
script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
script_cwe_id(119);
script_set_attribute(attribute:"vuln_publication_date", value:"2007/03/09");
script_set_attribute(attribute:"patch_publication_date", value:"2007/07/19");
script_set_attribute(attribute:"plugin_publication_date", value:"2007/07/19");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe", value:"cpe:/a:ipswitch:imail");
script_set_attribute(attribute:"thorough_tests", value:"true");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Windows");
script_copyright(english:"This script is Copyright (C) 2007-2022 Tenable Network Security, Inc.");
script_dependencies("smtpserver_detect.nasl", "popserver_detect.nasl", "doublecheck_std_services.nasl");
script_require_ports("Services/smtp", 25, "Services/pop3", 110, "Services/imap", 143);
exit(0);
}
include("global_settings.inc");
include("imap_func.inc");
include("pop3_func.inc");
include("smtp_func.inc");
function check(port, proto, ver, banner)
{
local_var report;
if (! ver) return;
# There's a problem if it's < 9.21 (== 2006.21).
if (ver =~ "^([0-8]\.|9\.(0[0-9]$|[12]$))")
{
if (report_verbosity < 1)
security_hole(port);
else
{
report = '\n' +
'The installed version is : ' + ver + '\n' +
'The patched version is : 9.21\n';
if (report_verbosity > 1)
report += 'The '+proto+' banner on this port is :\n\n' + banner + '\n';
security_hole(port:port, extra: report);
}
# NB: it's possible to customize the banner, but unless thorough checks
# are enabled, we'll just stop.
if (! thorough_tests) exit(0);
}
}
# Do banner checks of various ports.
#
# - SMTP.
pl = get_kb_list("Services/smtp");
if (isnull(pl)) pl = make_list(25);
foreach port (pl)
{
if (!get_port_state(port)) continue;
if (get_kb_item('SMTP/'+port+'/broken')) continue;
banner = get_smtp_banner(port:port);
if (banner && " (IMail " >< banner)
{
pat = "^[0-9][0-9][0-9] .+ \(IMail ([0-9.]+) [0-9]+-[0-9]+\) NT-ESMTP Server";
matches = egrep(pattern:pat, string:banner);
if (matches)
{
foreach match (split(matches))
{
match = chomp(match);
ver = eregmatch(pattern:pat, string:match);
if (!isnull(ver))
{
ver = ver[1];
break;
}
}
}
check(port: port, ver: ver, banner: banner, proto: 'SMTP');
}
}
# - POP3.
pl = get_kb_list("Services/pop3");
if (isnull(pl)) pl = make_list(110);
foreach port(pl)
{
if (!get_port_state(port)) continue;
banner = get_pop3_banner(port:port);
if (banner && " (IMail " >< banner)
{
pat = "NT-POP3 Server .+ \(IMail ([0-9.]+) [0-9]+-[0-9]+\)";
matches = egrep(pattern:pat, string:banner);
if (matches)
{
foreach match (split(matches))
{
match = chomp(match);
ver = eregmatch(pattern:pat, string:match);
if (!isnull(ver))
{
ver = ver[1];
break;
}
}
}
check(port: port, ver: ver, banner: banner, proto: 'POP3');
}
}
# - IMAP.
pl = get_kb_list("Services/imap");
if (isnull(pl)) pl = make_list(143);
foreach port(pl)
{
if (!get_port_state(port)) continue;
banner = get_imap_banner(port:port);
if (banner && " (IMail " >< banner)
{
pat = "IMAP4 Server \(IMail ([0-9.]+) [0-9]+-[0-9]+\)";
matches = egrep(pattern:pat, string:banner);
if (matches)
{
foreach match (split(matches))
{
match = chomp(match);
ver = eregmatch(pattern:pat, string:match);
if (!isnull(ver))
{
ver = ver[1];
break;
}
}
}
check(port: port, ver: ver, banner: banner, proto: 'IMAP');
}
}
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2795
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3925
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3926
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3927
www.ipswitch.com/support/imail/releases/im200621.asp
www.nessus.org/u?194eb0fd
seclists.org/bugtraq/2007/Jul/275
seclists.org/bugtraq/2007/Jul/277
www.securityfocus.com/archive/1/474040/30/0/threaded
www.zerodayinitiative.com/advisories/ZDI-07-042/
www.zerodayinitiative.com/advisories/ZDI-07-043/