Plesk 8.1 & Mail Enable 1.96

[MonsterDK]

Hi,

I have been running PLESK 8.1 on a Windows 2003 Server.

The host installed PLESK for me and included Mail Enable 1.96 with it.
Before I go into the problem. I have been told by the host, that swsoft include that version with PLESK.

PROBLEM:
I would deal with this issue through PLESK but my server is currently down. And my host are not offering me any other solution to this as far as contacting swsoft they told me to use their forums.

OK...
Mail Enable that comes with PLESK if I am been told correctly and is 1.96 has serious Security issues.

My server has been infected with the W32/Backdoor.KKW trojan (windows/java.dll) which also broke my windows firewall (disabled it and won't re-enable).
After some research (http://www.mailenable.com/standardhistory.asp)
If you look on Mail Enabled official site you will see that later versions fix the security holes.
One of which Fixed: Security vulnerability with is this.... MailEnable POP Service (hotfix ME-10026).

Also going here...
http://forums.theplanet.com/lofiversion/index.php/t83487.html

Will show the exact same issue I had.

Because my host does not update the version of Mail Enable to fix the security hole. My server is compromised before they give it me back to manage myself (after it was last formatted).

They assure me that swsofts version will be fine. But I see this as an addon to their software.

Please confirm if there is a problem with the version of MailEnable you include or not.

SP1 on my server is installed and all updates was done.
The server was 1 week old from format. And there was nothing running on the server to allow a security flaw.

Please advise.

 

[MonsterDK]

Originally posted by MonsterDK
Hi,

I have been running PLESK 8.1 on a Windows 2003 Server.

The host installed PLESK for me and included Mail Enable 1.96 with it.
Before I go into the problem. I have been told by the host, that swsoft include that version with PLESK.

PROBLEM:
I would deal with this issue through PLESK but my server is currently down. And my host are not offering me any other solution to this as far as contacting swsoft they told me to use their forums.

OK...
Mail Enable that comes with PLESK if I am been told correctly and is 1.96 has serious Security issues.

My server has been infected with the W32/Backdoor.KKW trojan (windows/java.dll) which also broke my windows firewall (disabled it and won't re-enable).
After some research (http://www.mailenable.com/standardhistory.asp)
If you look on Mail Enabled official site you will see that later versions fix the security holes.
One of which Fixed: Security vulnerability with is this.... MailEnable POP Service (hotfix ME-10026).

Also going here...
http://forums.theplanet.com/lofiversion/index.php/t83487.html

Will show the exact same issue I had.

Because my host does not update the version of Mail Enable to fix the security hole. My server is compromised before they give it me back to manage myself (after it was last formatted).

They assure me that swsofts version will be fine. But I see this as an addon to their software.

Please confirm if there is a problem with the version of MailEnable you include or not.

SP1 on my server is installed and all updates was done.
The server was 1 week old from format. And there was nothing running on the server to allow a security flaw.

Please advise.

Can I have some response back to this please.

I need confirmation if this is a known issue or not so I can secure my server when I decide to put plesk back on.

 

[neoweo]

There was a former thread I can't find that said to apply these hotfixes to 1.96

http://www.mailenable.com/hotfix/default.asp

ME-10027: Monday, December 18, 2006
MailEnable Core Services Security Update
Priority: Critical
Applies to:
1.98 Standard Edition (and earlier)
1.6-1.84 Professional Edition
1.1-1.41 Enterprise Edition
2.0-2.35 Professional Edition
2.0-2.35 Enterprise Edition


Reason:
+ This security update provides updated services for MailEnable Standard, Professional, and Enterprise Editions.
+ The services have been updated to include additional checking/prevention against exploitation through any unforseen buffer overflow vulnerabilities.
+ These updates also contain patches to all previously published MailEnable hotfixes.


ME-10026: Monday, December 18, 2006
POP
Priority: Critical
For MailEnable Standard: version 1.98 and earlier
For MailEnable Professional: version 1.84, 2.35 and earlier
For MailEnable Enterprise: version 1.41 2.35 and earlier

Reason:
+ Security Vulnerability with MailEnable POP Service

1. Download this file
2. Instructions are contained within the associated Read-Me.txt

 

[PaulC]

MailEnable is bundled by SWsoft, you do not need to use this and SWsoft would not normally support this as it is not their product.

As neoweo mentions there has been a post about this. The SWsoft site contains a link for the ME patch, the Auto Updater within Plesk 8.1 also contains this.

Alternatively you can upgrade MailEnable to the latest version by download it from www.mailenable.com

 

[MonsterDK]

Originally posted by PaulC
MailEnable is bundled by SWsoft, you do not need to use this and SWsoft would not normally support this as it is not their product.

As neoweo mentions there has been a post about this. The SWsoft site contains a link for the ME patch, the Auto Updater within Plesk 8.1 also contains this.

Alternatively you can upgrade MailEnable to the latest version by download it from www.mailenable.com

Did all you suggested.

PLESK with no domain.. fine.

As soon as domain is added... BOOOM hacked by a ROOT KIT..

Another format. costing me another 30 Euros

 

[Deltafox]

Same here, last week i installed new 8.1 windows server. Hacked within one week, did a reinstall yesterday. Possibly a hack of de POP service (regedit was pointed there).

I installed the latest update from mailenable website: ME-10027 (Plesk Updater failed.)

Am i safe now to turn on mailenable software? secunia says everything is patched: http://secunia.com/product/3882/?task=advisories

 

[MonsterDK]

Originally posted by Deltafox
Same here, last week i installed new 8.1 windows server. Hacked within one week, did a reinstall yesterday. Possibly a hack of de POP service (regedit was pointed there).

I installed the latest update from mailenable website: ME-10027 (Plesk Updater failed.)

Am i safe now to turn on mailenable software? secunia says everything is patched: http://secunia.com/product/3882/?task=advisories

Well bud.. I did that security fix and I was hacked again.

I have now ditched Plesk altogether as my host is the license holder and unhelpful and won't believe what I tell them.

I found the following.....
PLESK was fine until the domain was applied. At that point it was immediatly hacked with a rootkit.
Which breaks the firewall as well.

The host keeps telling me it is not PLESK it is some other software that is leaving an exploit.

Well I have minimum installed and everything I usually install is on the server except PLESK and its been over a week without been hacked. With PLESK and a domain it does not last 1 day.