I was so bent at Cisco we chucked on ebay everything Cisco except one PIX
firewall ... and dropped support on that. We switched to Sonicwall (more
than one) and DELL switches.
Christopher Checca
Packard Transport, Inc.
IT Department
24021 South Municipal Dr
PO Box 380
Channahon, IL. 60410
815
Is it possible to have the Web calendar displayed in MS Outlook while
connecting via IMAP. I would really like for the Outlook generated calendar
events to be accepted by the used and posted to the web calendar. I'm
running version 8.21. If an upgrade will help I will do that. Just need
some
So following the thread on SAs and the SMTP vuln I
sent in a support request to Ipswitch via email. I got the ticket number back.
That was a day ago and since then I havent heard a peep out of them
about it. The email I sent in simply asked if the SMTP vulnerability affected
all 8.2x
Heads up everyone.My IDS systemsare
reportingheavy scanning for the IMail SMTP exploit.
http://www.juniper.net/security/auto/vulnerabilities/vuln3414.html
Sincerely,
Korey VerlsteffenNetwork
AdministratorWebStream Internet Solutions
[EMAIL PROTECTED]http://www.webstream.net
Well, that answers that question -
aclientrunning 8.22 just had an SMTP crash. Therefor
8.22 must be vulnerable. Successful payload delivery - who knows? [ They
have an SA and are still in the final stages of moving to 2006 ].
- Original Message -
From:
Korey
Verlsteffen
which version of 2006 is not open to
this?
Bill Foresman
Matrosity Hosting
www.matrosity.com
850.656.2644
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Mike
NSent: Thursday, October 26, 2006 12:42 PMTo:
Imail_Forum@list.ipswitch.comSubject: Re: [IMail Forum] SMTP
That might not be what you think. SMTP has had a problem crashing since
v8.x came out. I'd do a little more research before determining it was
compromised.
Mike N wrote:
Well, that answers that question - a client running 8.22 just had an
SMTP crash. Therefor 8.22 must be vulnerable.
From what I understand both 8.2x and 2006
are vulnerable. Check here: http://www.securiteam.com/exploits/6G00L0KH5E.html
Troy D. Hilton
Serveon, Inc.
302-529-8640
[EMAIL PROTECTED]
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Matrosity Hosting
Sent:
Hi,
I'm getting tired about this this issue. In my opinion, the
following should be done:
Programmer at Ipswitch: Open your visual studio, load the
code, find the error and recompile it. I'm sure, that this needs not more than a
few hours. Just do it!
Release-Manager at Ipswitch: Zip the
So, 8.05 is vulnerable too, isn't it??
Regards,
Pere Ginabreda
-Mensaje original-
De: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] nombre de Troy D. Hilton
Enviado el: jueves, 26 de octubre de 2006 19:04
Para: Imail_Forum@list.ipswitch.com
Asunto: RE: [IMail Forum] SMTP Exploit
From what I understand both 8.2x and 2006 are vulnerable. Check here:
http://www.securiteam.com/exploits/6G00L0KH5E.html
It says 8.x, so I assume that 8.15 and earlier are also vulnerable.
Has Ipswitch made any recent statements about patches to pre-2006 versions?
Since I can't use 2006
which version of 2006 is not open to this?
2006.1 was the first with the fixes. .04 and lower is vulnerable.
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ:
So Ipswitch has let ALL of their customers sit vulnerable
regardless of having an SA?
Someone from Ipswitch really needs to inform us all of the
situation and EXACTLY when it will be corrected.
Bill Foresman
Matrosity Hosting
www.matrosity.com
850.656.2644
From: [EMAIL PROTECTED]
According to the article, yes.
Troy D. Hilton
Serveon, Inc.
302-529-8640
[EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Servei Tecnic [
MICROTECH ]
Sent: Thursday, October 26, 2006 1:10 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE:
At 01:24 PM 10/26/2006, you wrote:
I may be time to go public to the tech publications to increase the
pressure on ipswitch to come up w/ a solution..
So, 8.05 is vulnerable too, isn't it??
Brian L. Wolfsohnhttp://www.cus.com
CUS Business Systems Ft.Lauderdale,FL
Software for
I sent in a question to Imail support via
their email web form and it took 4 days to get a response. In the
meantime I had to call and resolve the issue over the phone. I have
another question that I sent via email that I never received a response on.
In the future I will only call for
This was the reason I sat put with 7.15. Ive
learned to always wait until Sandy
and some other here test the waters on the newer versions and detect all the
bugs/flaws and see them resolved before I make a move to upgrade. This is a
shame though that it hasnt been resolved in 8.x IMO,
Still no response from their regular
support on this specific issue And the clock keeps ticking.
Fortunately my MX is an ASSP box so I have
blocked inbound SMTP(25) for everyone except known customers. Im
watching my firewall logs and trying to catch the ones I missed. This whole
absurd
I'm going to say that it is what you think it is. You can search your system logs for "error 10038" and that might tell you for sure. We have seen thethe "non responding / still says running SMTP" beginning Monday. In all cases we see lines like:RCPT TO:
I read the link below. I am running IMAIL Server 2006.1 which is not
listed under affected products. May I assume that 2006.1 is not
vulnerable?
Larry Stroud
Director, Computer Services
CIS Project Manager - Phase IIB
BlackBoard Administrator
Groupwise Administrator
Instructor, Computer Studies
Just upgraded, again, and am on hold 23+ minutes with tech support. Nice.
Bill Foresman
Matrosity Hosting
www.matrosity.com
850.656.2644
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Larry Stroud
Sent: Thursday, October 26, 2006 1:42 PM
To:
Has Ipswitch made any recent statements about patches to pre-2006
versions?
Since I can't use 2006 because of its Mac non-support, I guess I need to
do
an emergency cut-over to another product.
Excuse you, but please provide proof that some one using ANY version of a
MAC OS can not access any
So those that have been effected by this
are they behind a SMTP firewall and still get hit or are these servers SMTP
live to the internet?
From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Korey Verlsteffen
Sent: Thursday, October 26, 2006
11:35 AM
To:
According to the doc. It's pre 2006.1 so you're OK. If you had 2006.04 you'd
be vulnerable.
Troy D. Hilton
Serveon, Inc.
302-529-8640
[EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Larry Stroud
Sent: Thursday, October 26, 2006 1:42 PM
http://secunia.com/advisories/21795 says the solution is to update to
version 2006.1.
http://www.ipswitch.com/support/imail/releases/im20061.asp says 2006.1 fixes
a vulnerability.
adamc
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Larry Stroud
Sent:
I tell our Mac customers to use Firefox which works fine.
Bill Foresman
Matrosity Hosting
www.matrosity.com
850.656.2644
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)
Sent: Thursday, October 26, 2006 2:22 PM
To:
Stay with possibly exploitable version of the
server or upgrade to a feature and bug rich version that doesn't have the
exploit? The answer is obvious, time to drop Imail. It's been a
long run (7 years) but the handwriting is clearly on the
wall.
Not so obvious, keep what you are
45 minutes on hold so far. I can't believe I'm paying for this kind of
support. The hold times, at least for me, have been this bad since 2006 came
out.
Very disappointing but this is a shining example of why smaller companies
take business away from larger ones.
Bill Foresman
Matrosity Hosting
I'm not sure how a firewall could help in this instance (if someone can enlighten me you would have my gratitude). As SMTP needs to be opened to the world in order for imail to receive mail, a firewall has simply to allow it (I think) or there is no mail, and that's that.Mark Pipkin [EMAIL
Which is my point to Bill Puetz!
John T
eServices For You
Life is a succession of lessons which must be lived to be understood.
Ralph Waldo Emerson (1802-1882)
-Original Message-
From: [EMAIL PROTECTED] [mailto:Imail_Forum-
[EMAIL PROTECTED] On Behalf Of Matrosity Hosting
Sent:
Ah, but some firewalls can be configured
to be a proxy or apply rules/configurations to the SMTP commands or both.
SMTP Message Screener via ISA Server is
one that comes to mind.
John T
eServices For You
Life is a succession
of lessons which must be lived to be understood.
Just external hosts I figure. An internal
host wouldn't get the corrupted 'rcpt to' command as the external
hostshouldn't accept it.
adamc
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Mark
PipkinSent: Thursday, October 26, 2006 14:24To:
Got through - 61 minutes.
Bill Foresman
Matrosity Hosting
www.matrosity.com
850.656.2644
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matrosity Hosting
Sent: Thursday, October 26, 2006 2:41 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail
I'm not sure how a firewall could help in this instance (if someone
can enlighten me
you would have my gratitude). As SMTP needs to be opened to the world in
order for
imail to receive mail, a firewall has simply to allow it (I think) or
there is no mail, and that's that.
or less.
2006.1 is not vulnerable to this exploit.
We are working on a update for 8.22 which will include one DLL that needs to
be copied over the old one during a stop / start of smtpd32. I'll post a
link here as soon as it's available.
Tripp
To Unsubscribe:
I'm hoping that having my IMGate servers as the published MX servers
instead of my iMail server reduces the exposure to this attack.
I do have the iMail server open for incoming SMTP, but it is known only
to customers. Port scanning would find it, obviously.
Perhaps blocking port 25 at the
Thanks Tripp!!!
Thanks,
Grant Griffith
Web Application Developer
Enhanced Telecommunications
http://www.etczone.com
812-932-1000
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Tripp Allen
Sent: Thursday, October 26, 2006 3:02 PM
To:
Ask them if a patch is forthcoming for 8x versions or if forced inplace upgrade is the only option (please). I gave up after exactly 61 minutes (weird huh?) and left a message. Otherwish have gotten no response from support mail, my sales contact, or even the product manager's voicemail.Matrosity
Here's one...
Using ASSP, should be safe right?
Dave
---
|Beach Computers|
|Affordable Hosting Solutions |
|http://www.beachcomp.com |
===
|Cheap Domain Warehouse |
|Get Your
Title: 2006.1 slow webmail login
Tripp,
If you could look at my reg with tech_mjs I would
appreciate it. If we set a quota on a user it takes at least 30 sec for them to
login. Set them to unlimited and its normal login speed.
Thanks,
Bill Foresman
Matrosity Hosting
www.matrosity.com
I am sure that would work, but as you know the more port 587 is
published, it will be hit also... We are looking into doing this as
well. We just put an IMGate server in front of our Barracuda we have
and have it filtering using just a few tests and recipient verification
and it dropped our load
Thanks Tripp, I think.
Will this be available for us that have hesitated to renew our SA's?
Mark
Tripp Allen wrote:
2006.1 is not vulnerable to this exploit.
We are working on a update for 8.22 which will include one DLL that needs to
be copied over the old one during a stop / start of
The dll will be placed on our FTP servers and a KB article will be created
with a link to that download. Anyone will be able to download the .dll and
install it, but you should only do that if you have 8.22.
Tripp
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
I would hope so. This is NOT a new feature... it is a fix for a flaw in
their software.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Imail
Sent: Thursday, October 26, 2006 3:26 PM
To: Imail_Forum@list.ipswitch.com
Subject: Re: [IMail Forum] SMTP
What is the best way to confirm your version number in Imail 2006?
Mark Reimer
IT System Admin
American CareSource
972-308-6887
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Tripp Allen
Sent: Thursday, October 26, 2006 2:29 PM
To:
Thanks Tripp for the clarification. You got an estimated ETA for this?
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Tripp Allen
Sent: Thursday, October 26, 2006 3:29 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE: [IMail Forum] SMTP Exploit Scanning
Is it possible to set port 25 to be SMTP Auth only? Of
course we would have to be able to still use the Relay Mail for Addresses to
include our gateway servers. It would be nice if we could do that as it would
not require you to force everyone to change to using port 587.
Thanks,
Grant
I am sure that would work, but as you know the more port 587 is
published, it will be hit also...
Imail 587 refuses any SMTP command, including the RCPT TO and
its vulnerability, if the SMTP session is started without an SMTP
AUTH after EHLO. IIRC, about the only command port 587 accepts
Is it possible to set port 25 to be SMTP Auth only?
yes, you swap IMail SMTP AUTH 587 to port 25 and swap unAUTH port 25
to port 587.
The problem with SMTP AUTH-only on port 25 is that roamers often are
blocked by the access providers from accessing port 25.
Len
To Unsubscribe:
The problem with SMTP AUTH-only on port 25 is that roamers often are
blocked by the access providers from accessing port 25.
Couldn't you configure your firewall to send both port 25 and 587 to port
587 on the Imail server?
Doug
To Unsubscribe:
Trip Allen you're my hero.
Thanks,
Sam
SJ.Stanaitis - Network Administrator
Decorative Product Source E-commerce Network
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Tripp Allen
Sent: Thursday, October 26, 2006 3:29 PM
To:
Whoops... Meant Tripp.
Thanks,
Sam
SJ.Stanaitis - Network Administrator
Decorative Product Source E-commerce Network
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Tripp Allen
Sent: Thursday, October 26, 2006 3:29 PM
To: Imail_Forum@list.ipswitch.com
Yep, guess I was looking to have both Auth Only. But port 25 having the
exception of the relay for addresses.
Thanks,
Grant Griffith
Web Application Developer
Enhanced Telecommunications
http://www.etczone.com
812-932-1000
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL
Well if you have ASSP set up for delaying it will likely kick the
connection anyway. It's doubtful these scanners are repeatedly trying
the same host over and over.
-Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Doug Traylor
Sent: Thursday,
Ummm... How about 2006.03? Is that going to be patched, or do I need to quickly perform an upgrade to 2006.1 I've been running 2006.1 on a test box for a month or so, and I'm not really too choked up about it... I'll need to go back to my documentation to see exactly WHAT the issues are, but I
You'll need to upgrade to 2006.1.
Tripp
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Gil
GomesSent: Thursday, October 26, 2006 4:13 PMTo:
Imail_Forum@list.ipswitch.comSubject: Re: [IMail Forum] SMTP Exploit
Scanning Going on NOW
Ummm... How about 2006.03? Is that
The problem with SMTP AUTH-only on port 25 is that roamers often
are blocked by the access providers from accessing port 25.
Couldn't you configure your firewall to send both port 25 and 587 to
port 587 on the Imail server?
sure, but when you have a another box like IMGate doing the MX
Tripp,
Remind me how we tell which release we are
on.
Mark Reimer
IT System Admin
American CareSource
972-308-6887
From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Tripp Allen
Sent: Thursday, October 26, 2006
3:19 PM
To: Imail_Forum@list.ipswitch.com
You know youre not on 2006.1 when
your box gets pwn3d by a script kiddie.
Sorrykinda grumpy after this mess.
From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Mark Reimer
Sent: Thursday, October 26, 2006
4:21 PM
To: Imail_Forum@list.ipswitch.com
Subject: RE:
Lovely... Just lovely... -Original Message-From: "Tripp Allen" Sent 10/26/2006 4:19:06 PMTo: Imail_Forum@list.ipswitch.comSubject: RE: [IMail Forum] SMTP Exploit Scanning Going on NOW
You'll need to upgrade to 2006.1.
Tripp
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
The easiest way is to telnet to port 25 and look at the
banner. For 2006.1 it will say 9.1. Or you can look at the release
notes.
Tripp
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Mark
ReimerSent: Thursday, October 26, 2006 4:21 PMTo:
What about 8.15, Tripp?
- Original Message -
From: Tripp Allen [EMAIL PROTECTED]
To: Imail_Forum@list.ipswitch.com
Sent: Thursday, October 26, 2006 2:02 PM
Subject: RE: [IMail Forum] SMTP Exploit Scanning Going on NOW
2006.1 is not vulnerable to this exploit.
We are working on a
We are not currently planning a patch for 8.15. SMTPD was rewritten in 8.2
and I can not confirm (or deny) that 8.1X is vulnerable right now.
Tripp
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty
Sent: Thursday, October 26, 2006 4:35 PM
To:
This is unnecessary, and undesirable to attempt to change one's entire
user base over to port 587.
Virtually any modern router/firewall that is worth a dime will do port
redirection, and have no issues with keeping track of what goes where.
This is after all very much like standard NAT...you
8.15 is vulnerable right now, I can personally confirm this. Two separate physical servers in separate places and unrelated IP space which I oversee were exploited on Monday and Wednesday (both were reported, with logs examples to techsupport). We have not been reluctant to maintain contracts
Then on the IMail box (using 9.1 in this example), you would simply
configure port 587 to force AUTH, but leave port 25 functional. The
gateway can deliver straight to port 25, and you can redirect port
25 to 587 for things beyond that immediate segment of your network,
so IMail port 25 is
- Original Message -
From: Robbie Pardue [EMAIL PROTECTED]
To: Imail_Forum@list.ipswitch.com
Sent: Thursday, October 26, 2006 4:26 PM
Subject: RE: [IMail Forum] SMTP Exploit Scanning Going on NOW
I will ask for nothing else from you ever.
How do you know this today? Do you
So, let me make sure I have Ipswich's answer
correctly.
We don't know if 8.15 is affected, therefore if you are running it, good
luck because we have no plan on giving you a fix.
Did I miss anything?
I
sure hope so.
Dave===Beach
ComputersAffordable Hosting
Yes I do, get the bike.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Doug Traylor
Sent: Thursday, October 26, 2006 2:36 PM
To: Imail_Forum@list.ipswitch.com
Subject: Re: [IMail Forum] SMTP Exploit Scanning Going on NOW
- Original Message
Here's one...
Using ASSP, should be safe right?
Not necessarily. That's something I have asked on the ASSP mailing list.
ASSP is not a gateway but rather, a proxy so it does eventually pass
recipient and data information to the SMTP server. If that happens to be
Imail and you don't have
Tripp said they don't know. He didn't say
they wouln't fix it.
We now have confirmation from Robbie that
8.15 is vulnerable.
So, over to you, Tripp. What are your
plans? Upgrades to 8.22, or a new SMTPD32 for 8.15? Or will the new SMTPD work
with 8.15?
-Dave DohertySkywaves,
I suggest talking with the product manager, Kevin
Gillis, about 8.15. The update for SMTPD I'm posting will ONLY work for
8.22.
Tripp
- Original Message -
From:
Dave Doherty
To: Imail_Forum@list.ipswitch.com
Sent: Thursday, October 26, 2006 7:10
PM
Subject:
The steps and files
to update 8.22 are located here: http://support.ipswitch.com/kb/IM-20061026-JH01.htm
Note this will ONLY work for 8.22.
Thanks,
Tripp Allen
Software Development Manager,
Messaging
Ipswitch, Inc.
] Update for
SMTP vulnerability in 8.22
The steps and files to update 8.22 are located here: http://support.ipswitch.com/kb/IM-20061026-JH01.htm
Note this will ONLY work for 8.22.
Thanks,
Tripp Allen
Software Development Manager, Messaging
Ipswitch, Inc.
Tripp,
I
wanted to say Thank You to you and Ipswitch. I hold an SA that entitles me to
upgrade to 2006, but I still preferred to run 8.22 for a while longer.
Downloaded and installed the patch. Now I can go worry about something
else.
Michael ThomasMathbox978-683-67181-877-MATHBOX (Toll
The install was very smooth and easy.
Many thanks to Tripp and to Ipswitch.
db
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
We are working on a update for 8.22 which will include one DLL that needs to
be copied over the old one during a stop / start of smtpd32. I'll post a
link here as soon as it's available.
Tripp
What about an update to 8.1x?
Mike N
FXOL
To Unsubscribe:
I suggest talking with the product manager, Kevin Gillis, about 8.15. The
update for SMTPD I'm posting will ONLY work for 8.22.
I can definately tell you 8.15 has the problem
Mike N
FXOL
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive:
vulnerability in 8.22
The steps and files to update 8.22 are located here: http://support.ipswitch.com/kb/IM-20061026-JH01.htm
Note this will ONLY work for 8.22.
Thanks,
Tripp Allen
Software Development Manager, Messaging
Ipswitch, Inc.
--
No virus found
Hi Tripp,
Thanks for jumping on this. Is there an upgrade path from 8.15 to 8.2 for
those with a valid SA, or is it a reinstall?
Any gotchas we should be aware of?
Until a couple of other issues are resolved, we're still not comfortable
with going to 2006.1.
Thanks in advance.
Darin.
-
-20061026-JH01.htm Note this will ONLY
work for 8.22.
TA
TA
TA
TA Thanks,
TA
TA Tripp Allen
TA
TA Software Development Manager, Messaging
TA
TA Ipswitch, Inc.
TA
TA
TA
Don Brown - Dallas, Texas USA Internet Concepts, Inc.
[EMAIL PROTECTED] http
Hi Darin,
Can you share what the main issues are that you'd like to see resolved
before upgrading to 2006.1? Chances are that others may share similar
sentiments and we'd like to prioritize and address them.
Bye for now,
kg
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL
82 matches
Mail list logo
