Detections
Analytics

AXIGEN Mail Server < 2.0.0 Multiple Remote Vulnerabilities

critical Nessus Plugin ID 24321

Language:

Synopsis

The remote mail server is affected by multiple vulnerabilities.

Description

The remote host is running AXIGEN Mail Server, a messaging system for Linux and BSD.

The POP3 server component of AXIGEN Mail Server contains a format string vulnerability because it calls syslog() when logtypeis set to 'system'. In addition, the IMAP server component is affected by two denial of service issues involving PLAIN and CRAM-MD5 authentication methods. An unauthenticated, remote attacker can leverage these issues to crash the IMAP service and possibly execute arbitrary code remotely.

Solution

Upgrade to AXIGEN Mail Server version 2.0.0 or later.

See Also

http://www.axigen.com/forum/showthread.php?p=2386#post2386

Plugin Details

Severity: Critical

ID: 24321

File Name: axigen_imap_auth_dos.nasl

Version: 1.26

Type: remote

Published: 2/9/2007

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:gecad:axigen_mail_server

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2/8/2007

Reference Information

CVE: CVE-2007-0886, CVE-2007-0887

BID: 22473, 22603