MailEnable Unsafe DLL Loading Vulnerability in Administrative Executable Allowing Local Arbitrary Code Execution

A vulnerability exists in MailEnable versions prior to 10.54, allowing local arbitrary code execution through unsafe DLL loading. The administrative executable attempts to load MEAINFY.DLL from its application directory without proper integrity validation or secure search order. This flaw enables a local attacker with write permissions to place a malicious MEAINFY.DLL in an attacker-writable location. When the executable is run, it loads the compromised library and executes code with the process's privileges, potentially leading to local privilege escalation if executed with elevated rights.

Impact

Exploitation of this vulnerability allows for local arbitrary code execution, with the executed code running under the privileges of the MailEnable administrative process. This could result in local privilege escalation, especially if the administrative executable is run with elevated rights.