search menu icon-carat-right cmu-wordmark

CERT Coordination Center

IMail Server LDAP daemon buffer overflow

Vulnerability Note VU#972334

Original Release Date: 2004-02-23 | Last Revised: 2004-03-19


A buffer overflow in the LDAP server component supplied with some versions of the Ipswitch IMail Server could allow a remote attacker to execute arbitrary code on the vulnerable system.


A buffer overflow flaw exists in the way that the Lightweight Directory Access Protocol (LDAP) server included with the IMail Server handles messages with overly long tags. This results in a vulnerability that can be exploited by a remote attacker who has the ability to supply a specially crafted message to the server.

NOTE: The CERT/CC is aware of publicly available exploit code for this vulnerability and has received reports of active reconnaissance for, and exploitation of, vulnerable systems.


A remote attacker may be able to execute arbitrary code in the context of Administrator on vulnerable systems running Windows 2000 or Windows XP. Furthermore, successful exploitation has been reported to cause the LDAP service to crash, resulting in a denial-of-service condition.


Apply a patch from the vendor

Ipswitch has released patches to address this vulnerability. Please see the Systems Affected section of this document for more details.

Filter network traffic for the LDAP service

Block or restrict access to the LDAP service (389/tcp) on affected systems from untrusted networks such as the Internet. Sites, particularly those who are not able to apply the patches, are encouraged to consider implementing this workaround. Note that this change may break some desired functionality depending on particular site configuration details. As a general rule and a matter of good security practice, the CERT/CC recommends blocking access to all services that are not explicitly required.

Vendor Information


Ipswitch Inc. Affected

Updated:  February 23, 2004



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


Ipswitch, Inc. has published a patch for this issue in IMail Server 8.05 Hotfix 2. Users are encouraged to review this information and apply the patch as soon as possible.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



Thanks to iDefense Labs for reporting this vulnerability.

This document was written by Chad R Dougherty.

Other Information

CVE IDs: None
Severity Metric: 38.48
Date Public: 2004-02-17
Date First Published: 2004-02-23
Date Last Updated: 2004-03-19 19:47 UTC
Document Revision: 11

Sponsored by CISA.