A critical buffer overflow in Tabs Mail Carrier 2.5.1 allows unauthenticated remote attackers to execute arbitrary code via the SMTP service.

A buffer overflow exists in the processing of the SMTP MAIL FROM command, where an oversized buffer can overwrite the EIP register. This allows an unauthenticated attacker to inject and execute a bind shell payload remotely via port 25.

With a CVSS score of 9.8, this vulnerability represents a critical risk, as it allows for full system takeover without requiring authentication. Compromise could result in complete unauthorized access to mail servers, interception of sensitive communications, and further lateral movement within the corporate network.

Immediate Action: Identify and restrict access to the SMTP service on port 25 while seeking a vendor-supplied patch or upgrading to a secure version.

Proactive Monitoring: Monitor SMTP traffic logs for unusually large MAIL FROM commands or unexpected connection attempts to the mail server.

Compensating Controls: Deploy a Web Application Firewall or an SMTP proxy capable of inspecting and filtering oversized or malformed SMTP commands to prevent the buffer overflow from reaching the application.

Public Exploit Available: Unknown

Given the ease of exploitation and the high severity, immediate remediation is required for all instances of Tabs Mail Carrier 2.5.1. Restricting network access to the vulnerable SMTP port is a mandatory temporary measure until a permanent patch is applied.