MailEnable Unsafe DLL Loading Vulnerability Allowing Local Arbitrary Code Execution

A vulnerability exists in MailEnable versions prior to 10.54 due to unsafe loading of the MEAISP.DLL file. The MailEnable administrative executable loads this DLL from the installation directory without proper integrity checks or a secure search order. This flaw allows a local attacker with write access to the directory to place a malicious MEAISP.DLL, which is then executed, leading to arbitrary code execution with the privileges of the MailEnable process.

Impact

Exploitation of this vulnerability allows for local arbitrary code execution, with the executed code running under the privileges of the MailEnable process.

Remediation

Users can update to MailEnable version 10.54 or later to address this vulnerability.