Title: PureMessage for Microsoft Exchange RTF Multiple Denial Of Service Vulnerabilities
Severity: MODERATE
Description:
PureMessage for Microsoft Exchange is an email scanning and filtering product for Microsoft Exchange.
PureMessage for Microsoft Exchange is prone to multiple remote denial-of-service vulnerabilities because the application fails to properly process certain messages.
The following denial-of-service vulnerabilities are present:
1. Sophos PureMessage Scanner service ('PMScanner.exe') may crash when processing certain PDF and rich text (RTF) files.
2. The process 'EdgeTransport.exe' may crash when PureMessage modifies the RTF content of TNEF-encoded messages.
An attacker may exploit these issues to crash the affected application, denying service to legitimate users.
PureMessage 3.0 is vulnerable; other versions may also be affected.
Affected Products:
- Sophos PureMessage for Microsoft Exchange 3.0