CVE-2003-1177 - Buffer overflow in the base64 decoder in MERCUR Mailserver 4.2 before SP3a allows remote attackers t

CVE-2003-1177

Summary

Buffer overflow in the base64 decoder in MERCUR Mailserver 4.2 before SP3a allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long (1) AUTH command to the POP3 server or (2) AUTHENTICATE command to the IMAP server.

References

Vulnerable Configurations

cpe:2.3:a:atrium_software:mercur_mailserver:3.3:*:*:*:*:*:*:*
cpe:2.3:a:atrium_software:mercur_mailserver:3.3:*:*:*:*:*:*:*
cpe:2.3:a:atrium_software:mercur_mailserver:3.3_sp1:*:*:*:*:*:*:*
cpe:2.3:a:atrium_software:mercur_mailserver:3.3_sp1:*:*:*:*:*:*:*
cpe:2.3:a:atrium_software:mercur_mailserver:3.3_sp2:*:*:*:*:*:*:*
cpe:2.3:a:atrium_software:mercur_mailserver:3.3_sp2:*:*:*:*:*:*:*
cpe:2.3:a:atrium_software:mercur_mailserver:4.1:*:*:*:*:*:*:*
cpe:2.3:a:atrium_software:mercur_mailserver:4.1:*:*:*:*:*:*:*
cpe:2.3:a:atrium_software:mercur_mailserver:4.1_sp1:*:*:*:*:*:*:*
cpe:2.3:a:atrium_software:mercur_mailserver:4.1_sp1:*:*:*:*:*:*:*
cpe:2.3:a:atrium_software:mercur_mailserver:4.2:*:*:*:*:*:*:*
cpe:2.3:a:atrium_software:mercur_mailserver:4.2:*:*:*:*:*:*:*
cpe:2.3:a:atrium_software:mercur_mailserver:4.2_sp1:*:*:*:*:*:*:*
cpe:2.3:a:atrium_software:mercur_mailserver:4.2_sp1:*:*:*:*:*:*:*
cpe:2.3:a:atrium_software:mercur_mailserver:4.2_sp2:*:*:*:*:*:*:*
cpe:2.3:a:atrium_software:mercur_mailserver:4.2_sp2:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 11-07-2017 - 01:29)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	8861 8889
confirm	http://www.atrium-software.com/mail%20server/pub/mcr42sp3a.html
fulldisc	20031024 Vulnerability in MERCUR Mail Server v4.2 SP3 and below
misc	http://www.securiteam.com/windowsntfocus/6U00N1P8KC.html
osvdb	2688
secunia	10038
xf	mercur-auth-command-dos(13468)

Last major update

11-07-2017 - 01:29

Published

31-12-2003 - 05:00

Last modified

11-07-2017 - 01:29