MailEnable Unsafe DLL Loading Vulnerability Allowing Local Arbitrary Code Execution

A vulnerability exists in MailEnable versions prior to 10.54, allowing local arbitrary code execution through unsafe DLL loading. The MailEnable administrative executable loads MEAISO.DLL from its installation directory without proper integrity checks or a secure search order. A local attacker with write access to the directory can place a malicious MEAISO.DLL, which is then executed with the privileges of the process when the executable starts.

Impact

Exploitation of this vulnerability allows for local arbitrary code execution with the privileges of the MailEnable administrative process.

Remediation

Users can update to MailEnable version 10.54 or later to address this vulnerability.