What’s Vulnerable › Vulnerabilities

CVE-2006-3277

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2006-06-28 · updated 2026-06-16
• Weakness: CWE-399

Description

The SMTP service of MailEnable Standard 1.92 and earlier, Professional 2.0 and earlier, and Enterprise 2.0 and earlier before the MESMTPC hotfix, allows remote attackers to cause a denial of service (application crash) via a HELO command with a null byte in the argument, possibly triggering a length inconsistency or a missing argument.

Affected products

• Mailenable Enterprise: through 1.00; through 1.01; through 1.1; through 1.2; through 1.02; through 1.03
• Mailenable Professional: 1.0.004, 1.0.005, 1.0.006, 1.0.007, 1.0.008, 1.0.009 (+59)

References

• http://secunia.com/advisories/20790
• http://securitytracker.com/id?1016376
• http://www.divisionbyzero.be/?p=173
• http://www.divisionbyzero.be/?p=174
• http://www.mailenable.com/hotfix/mesmtpc.zip
• http://www.osvdb.org/26791
• http://www.securityfocus.com/archive/1/438374/100/0/threaded
• http://www.securityfocus.com/bid/18630
• http://www.vupen.com/english/advisories/2006/2520
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27387
• http://secunia.com/advisories/20790
• http://securitytracker.com/id?1016376

Get alerted when CVE-2006-3277 or the next vulnerability affects your stack