Sign-up

ID

VAR-200602-0338


CVE

CVE-2006-0790


TITLE

Rockliffe MailSite Denial of Service Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2006-0961 // CNNVD: CNNVD-200602-298

DESCRIPTION

Rockliffe MailSite 7.0 and earlier allows remote attackers to cause a denial of service by sending crafted LDAP packets to port 389/TCP, as demonstrated by the ProtoVer LDAP testsuite. Rockliffe MailSite is prone to multiple unspecified vulnerabilities. These issues may be triggered by malformed LDAP data. The exact impact of these vulnerabilities is not known at this time. Although the issues are known to crash the server, the possibility of remote code execution is unconfirmed. This BID will be updated as further information is made available. TITLE: MailSite LDAP Service Denial of Service Vulnerability SECUNIA ADVISORY ID: SA18888 VERIFY ADVISORY: http://secunia.com/advisories/18888/ CRITICAL: Less critical IMPACT: DoS WHERE: >From local network SOFTWARE: MailSite 5.x http://secunia.com/product/1698/ MailSite 6.x http://secunia.com/product/5898/ MailSite 7.x http://secunia.com/product/6895/ DESCRIPTION: Evgeny Legerov has reported a vulnerability in MailSite, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an error in the LDAP server within the handling of certain requests. SOLUTION: Restrict access to the LDAP service. PROVIDED AND/OR DISCOVERED BY: Evgeny Legerov, GLEG Ltd. ORIGINAL ADVISORY: http://lists.immunitysec.com/pipermail/dailydave/2006-February/002926.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.8

sources: NVD: CVE-2006-0790 // CNVD: CNVD-2006-0961 // BID: 16675 // PACKETSTORM: 43870

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2006-0961

AFFECTED PRODUCTS

vendor:rockliffemodel:mailsitescope:eqversion:7.0.31

Trust: 1.9

vendor:rockliffemodel:mailsitescope:eqversion:6.1.22

Trust: 1.9

vendor:rockliffemodel:mailsitescope:eqversion:5.3.4

Trust: 1.9

vendor:rockliffemodel:mailsitescope:eqversion:4.2.10

Trust: 1.9

vendor:rockliffemodel:mailsitescope:eqversion:5

Trust: 1.9

vendor:mailsitemodel:rockliffescope:eqversion:5.3.4

Trust: 0.6

vendor:mailsitemodel:rockliffescope:eqversion:6.1.22

Trust: 0.6

vendor:mailsitemodel:rockliffescope:eqversion:4.2.10

Trust: 0.6

vendor:mailsitemodel:rockliffescope:eqversion:5

Trust: 0.6

vendor:mailsitemodel:rockliffescope:eqversion:7.0.31

Trust: 0.6

sources: CNVD: CNVD-2006-0961 // BID: 16675 // CNNVD: CNNVD-200602-298 // NVD: CVE-2006-0790

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2006-0790
value: MEDIUM

Trust: 1.0

CNVD: CNVD-2006-0961
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-200602-298
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2006-0790
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

CNVD: CNVD-2006-0961
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

sources: CNVD: CNVD-2006-0961 // CNNVD: CNNVD-200602-298 // NVD: CVE-2006-0790

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2006-0790

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200602-298

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-200602-298

EXTERNAL IDS

db:BIDid:16675

Trust: 2.5

db:NVDid:CVE-2006-0790

Trust: 2.2

db:SECUNIAid:18888

Trust: 1.7

db:VUPENid:ADV-2006-0598

Trust: 1.6

db:CNVDid:CNVD-2006-0961

Trust: 0.6

db:MLISTid:[DAILYDAVE] 20060214 MAILSITE (WORLDMAIL) FUN

Trust: 0.6

db:XFid:24686

Trust: 0.6

db:CNNVDid:CNNVD-200602-298

Trust: 0.6

db:PACKETSTORMid:43870

Trust: 0.1

sources: CNVD: CNVD-2006-0961 // BID: 16675 // PACKETSTORM: 43870 // CNNVD: CNNVD-200602-298 // NVD: CVE-2006-0790

REFERENCES

url:http://www.securityfocus.com/bid/16675

Trust: 2.2

url:http://lists.immunitysec.com/pipermail/dailydave/2006-february/002926.html

Trust: 2.0

url:http://secunia.com/advisories/18888

Trust: 1.6

url:http://www.vupen.com/english/advisories/2006/0598

Trust: 1.0

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/24686

Trust: 1.0

url:http://xforce.iss.net/xforce/xfdb/24686

Trust: 0.6

url:http://www.frsirt.com/english/advisories/2006/0598

Trust: 0.6

url:http://www.rockliffe.com/products/mailsite/

Trust: 0.3

url:http://www.gleg.net/protover_ldap_sample.shtml

Trust: 0.3

url:http://secunia.com/secunia_security_advisories/

Trust: 0.1

url:http://secunia.com/product/5898/

Trust: 0.1

url:http://secunia.com/product/1698/

Trust: 0.1

url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Trust: 0.1

url:http://secunia.com/product/6895/

Trust: 0.1

url:http://secunia.com/advisories/18888/

Trust: 0.1

url:http://secunia.com/about_secunia_advisories/

Trust: 0.1

sources: CNVD: CNVD-2006-0961 // BID: 16675 // PACKETSTORM: 43870 // CNNVD: CNNVD-200602-298 // NVD: CVE-2006-0790

CREDITS

Discovery is credited to Evgeny Legerov.

Trust: 0.9

sources: BID: 16675 // CNNVD: CNNVD-200602-298

SOURCES

db:CNVDid:CNVD-2006-0961
db:BIDid:16675
db:PACKETSTORMid:43870
db:CNNVDid:CNNVD-200602-298
db:NVDid:CVE-2006-0790

LAST UPDATE DATE

2024-11-23T23:13:29.266000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2006-0961date:2006-02-19T00:00:00
db:BIDid:16675date:2006-02-15T22:52:00
db:CNNVDid:CNNVD-200602-298date:2006-02-20T00:00:00
db:NVDid:CVE-2006-0790date:2024-11-21T00:07:20.797

SOURCES RELEASE DATE

db:CNVDid:CNVD-2006-0961date:2006-02-19T00:00:00
db:BIDid:16675date:2006-02-15T00:00:00
db:PACKETSTORMid:43870date:2006-02-15T18:37:35
db:CNNVDid:CNNVD-200602-298date:2006-02-19T00:00:00
db:NVDid:CVE-2006-0790date:2006-02-19T21:02:00