Vulnerability Name: MailEnable POP Service "PASS" Command Buffer Overflow CVSS Base Score: 10/10 Exploit Range: Remote Confidentiality Impact: Complete CVE ID: CVE-2006-6605 RM Risk: High Discoverer: Carsten Eiram, Secunia Research Affected Software: - MailEnable Enterprise Edition 2.35 - MailEnable Professional Edition 2.35 Severity: - Rating: Highly Critical - Impact: System Compromise - Where: Remote Description of Vulnerability: The vulnerability is caused due to a boundary error in the POP service when handling arguments passed to the "PASS" command. This can be exploited to cause a stack-based buffer overflow by passing an overly long, specially crafted string as argument to the affected command. Successful exploitation allows execution of arbitrary code. Solution: Apply hotfix. Time Table: - 18/12/2006 - Vendor notified. - 18/12/2006 - Vendor response and hotfix released. - 18/12/2006 - Public disclosure.