Clearswift MIMEsweeper 5.0.5, when it has been upgraded from MAILsweeper for SMTP version 4.3 or MAILsweeper Business Suite I or II, allows remote attackers to bypass scanning by including encrypted data in a mail message, which causes the message to be marked as Clean instead of Encrypted.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mailsweeper_business_suite_i | Clearswift | * | * |
| Mailsweeper_business_suite_ii | Clearswift | * | * |
| Mailsweeper_for_smtp | Clearswift | 4.3 (including) | 4.3 (including) |
| Mimesweeper_for_web | Clearswift | 5.0.5 (including) | 5.0.5 (including) |
References
- http://download.mimesweeper.com/www/TechnicalDocumentation/MSWSMTP505UpdateReadMe.htm
- http://secunia.com/advisories/13160
- http://www.osvdb.org/11602
- http://www.securityfocus.com/bid/11669
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18035
- http://download.mimesweeper.com/www/TechnicalDocumentation/MSWSMTP505UpdateReadMe.htm
- http://secunia.com/advisories/13160
- http://www.osvdb.org/11602
- http://www.securityfocus.com/bid/11669
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18035