Denial of Service in McAfee Email Gateway (formerly IronMail)

vendor:

Email Gateway (formerly IronMail)

by:

Nahuel Grisolía

4,6

CVSS

MEDIUM

Denial of Service

N/A

CWE

Product Name: Email Gateway (formerly IronMail)

Affected Version From: Secure Mail (Ironmail) ver.6.7.1

Affected Version To: Secure Mail (Ironmail) ver.6.7.1

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: FreeBSD 6.2 / Apache-Coyote 1.1

2010

Denial of Service in McAfee Email Gateway (formerly IronMail)

Users inside the CLI can run some kind of “Fork Bomb” in order to saturate system resources because of an insecure ulimit value.

Mitigation:

Install McAfee Email Gateway 6.7.2 Hotfix 2.

Source

Exploit-DB raw data:

Advisory Name: Denial of Service in McAfee Email Gateway (formerly IronMail)
Vulnerability Class: Denial of Service
Release Date: Tue Apr 6, 2010
Affected Applications: Secure Mail (Ironmail) ver.6.7.1
Affected Platforms: FreeBSD 6.2 / Apache-Coyote 1.1
Local / Remote: Local
Severity: Medium – CVSS: 4.6 (AV:L/AC:L/Au:S/C:N/I:N/A:C)
Researcher: Nahuel Grisolía

Vendor Status: Official Patch Released. Install McAfee Email Gateway 6.7.2 Hotfix 2.
Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf

Vulnerability Description:
Users inside the CLI can run some kind of “Fork Bomb” in order to saturate system resources because
of an insecure ulimit value.

Download:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/12093.pdf (cybsec_advisory_2010_0401.pdf)