Check Point Advisories

Ipswitch IMail IMAP Service DELETE Command Buffer Overflow (CVE-2004-1520)

Vulnerability
Protection

Check Point Reference:	CPAI-2004-197
Date Published:	12 Oct 2009
Severity:	High
Last Updated:	Monday 12 October, 2009
Source:
Industry Reference:	CVE-2004-1520
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	The Internet Message Access Protocol (IMAP) allows the access and manipulation of electronic mail. The protocol permits the manipulation of mailboxes on a remote server. The protocol allows a remote client, among other operations, to create, delete, or rename mailboxes on the server side. There is a vulnerability in the way the Ipswitch IMail IMAP service processes the DELETE command. An argument to this command that is excessively long will trigger a stack-based buffer overflow. An attacker can exploit this vulnerability to terminate the service and create a denial of service condition or execute arbitrary code. In a simple attack exploiting this vulnerability, the IMAP component of the target IMail server will terminate closing all current connections and the listening port, resulting in a complete denial of service. A new entry is created in the System Log with the following message: "The IMail IMAP4 Server service terminated unexpectedly." In the case of a more sophisticated attack, arbitrary code can be executed with the privileges of the account running IMAP4d32.exe process. By default this process is running as LocalSystem account. The behavior of the target system will be dependent on the malicious code.

Protection Overview

This protection will detect and block attempts to transfer malicious XML files over HTTP.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Ipswitch IMail IMAP Service DELETE Command Buffer Overflow protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: IMAP Protocol Violation.
Attack Information: Ipswitch IMail IMAP service DELETE command buffer overflow