Computalynx SMTP Server Vulnerability

HIGH (10.0) No Patch (9594 days)
buffer-overflowcmailcomputalynxremote-exploitationsmtp-server

Threat Intelligence

⚠️ CRITICAL GAP - Exploits exist but no detection available
EPSS Score: 6.54% chance of exploitation (percentile: 91%)
🔍 Detection Tools: None available in major open-source tools
⚔️ Exploit Availability: Exploit-DB

How we test →

What is it?

Computalynx CMail is a commercial email server software used by some organizations for sending and receiving emails. This vulnerability allows an attacker to execute arbitrary code on the server by exploiting a buffer overflow in the MAIL FROM command, potentially leading to unauthorized access and data tampering.

Am I affected?

You're affected if you use Computalynx CMail 2.4 or 2.3 SP2 SMTP servers. To check if your system is vulnerable, run the following command:

grep "MAIL FROM" /var/log/smtpd.log

Note: This vulnerability does not affect similar products like IBM Mail Server or Microsoft Exchange.

Affected Products

Computalynx / CMail

How to fix

To fix this vulnerability, upgrade to Computalynx CMail 2.5 or later. Alternatively, apply the following immediate mitigations:

  1. Restrict network access to your SMTP server (firewall it from the public internet).
  2. Audit log files for suspicious activity patterns.
  3. Monitor for unauthorized changes to system configuration.

You can download the patched version from Computalynx's website: https://www.computalynx.com/support/download/

References