Unscored severity · published Mar 23, 2007
CVE-2007-1637
Multiple buffer overflows in the IMAILAPILib ActiveX control (IMailAPI.dll) in Ipswitch IMail Server before 2006.2 allow remote attackers to execute arbitrary code via the (1)…
–
CVSS
5.6%
EPSS
No
On KEV
Description
Multiple buffer overflows in the IMAILAPILib ActiveX control (IMailAPI.dll) in Ipswitch IMail Server before 2006.2 allow remote attackers to execute arbitrary code via the (1) WebConnect and (2) Connect members in the (a) IMailServer control; (3) Sync3 and (4) Init3 members in the (b) IMailLDAPService control; and the (5) SetReplyTo member in the (c) IMailUserCollection control.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.6% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Imail · Ipswitch
2006 · source: NVD
IP
Imail Plus · Ipswitch
2006 · source: NVD
IP
Imail Premium · Ipswitch
2006 · source: NVD
IC
Ipswitch Collaboration Suite · Ipswitch
2006_standard · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-1637
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-1637
labs.idefense.com
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=487
Vendor Advisory
http://secunia.com/advisories/24422
support.ipswitch.com
http://support.ipswitch.com/kb/IM-20070305-JH01.htm
www.securitytracker.com
http://www.securitytracker.com/id?1017737
www.vupen.com
http://www.vupen.com/english/advisories/2007/0853
More from Imail
7.5
CVE-2005-2160
IMail stores usernames and passwords in cleartext in a cookie, which allows remote attackers to obtain sensitive information
–
CVE-2011-1430
The STARTTLS implementation in the server in Ipswitch IMail 11.03 and earlier does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands…
–
CVE-2007-2795
Multiple buffer overflows in Ipswitch IMail before 2006.21 allow remote attackers or authenticated users to execute arbitrary code via (1) the authentication feature in…
–
CVE-2007-5094
Heap-based buffer overflow in iaspam.dll in the SMTP Server in Ipswitch IMail Server 8.01 through 8.11 allows remote attackers to execute arbitrary code via a set of four…
–
CVE-2005-1256
Stack-based buffer overflow in the IMAP daemon (IMAPD32.EXE) in IMail 8.13 in Ipswitch Collaboration Suite (ICS), and other versions before IMail Server 8.2 Hotfix 2, allows…