Check Point Advisories

Preemptive Protection against Atrium MERCUR IMAP SUBSCRIBE Buffer Overflow Vulnerability

Check Point Reference:	CPAI-2007-055
Date Published:	26 Apr 2007
Severity:	High
Last Updated:	Monday 01 January, 2007
Source:	Secunia Advisory: SA24619
Industry Reference:	CVE-2007-1579
Protection Provided by:
Who is Vulnerable?	Atrium MERCUR Messaging Server 5.00.14 SP4 and prior
Vulnerability Description	A buffer overflow vulnerability exists in Atrium MERCUR Messaging Server. Atrium MERCUR Messaging Server is a mail application for Windows. The flaw is in the Atrium MERCUR IMAP service. Internet Message Access Protocol (IMAP) is a standard protocol for accessing e-mail from a local server that provides management of received messages on a remote server. Several mail servers contain buffer overflow errors in the way they handle commands. A remote attacker can exploit this issue to trigger a buffer overflow which may lead to an application crash and to arbitrary code execution.
Vulnerability Details	The vulnerability is due to a boundary error when processing overly long IMAP SUBSCRIBE commands. A remote attacker can exploit this flaw via a specially crafted SUBSCRIBE command. Successful exploitation may allow an attacker to create a denial of service condition or execute arbitrary code on an affected system.