Vulnerability record · CVE-1999-1551 · published 2 March 1999
CVE-1999-1551: Ipswitch IMail Service 5.0 buffer overflow via long URL
Ipswitch · Imail
Ipswitch IMail Service 5.0 contains a buffer overflow that is triggered by a long URL. A successful attack can crash the service and may allow arbitrary command execution. The record is old and thin, with no affected-version detail beyond 5.0 and no vendor advisory in the references.
Description
Buffer overflow in Ipswitch IMail Service 5.0 allows an attacker to cause a denial of service (crash) and possibly execute arbitrary commands via a long URL.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
high priorityThe flaw is remotely reachable without authentication, has public exploit references, and carries a very high EPSS score, though the CVSS 2.0 base score is only 5.0.
What it is
Ipswitch IMail Service 5.0 contains a buffer overflow that is triggered by a long URL. A successful attack can crash the service and may allow arbitrary command execution. The record is old and thin, with no affected-version detail beyond 5.0 and no vendor advisory in the references.
Impact
An attacker can cause a denial of service by crashing the service and may be able to execute arbitrary commands on the host. The CVSS 2.0 vector rates confidentiality and integrity impact as none and availability impact as partial.
Attack surface
The vulnerability is network-reachable (AV:N) with low attack complexity and no authentication required (AC:L/Au:N). No user interaction is indicated by the vector or description.
Exploitation
CISA KEV does not list this CVE, but EPSS is high at 0.71793 (99.4th percentile). SecurityFocus references are tagged Exploit and Patch, indicating public exploit code and a fix exist.
What to do
- Apply the vendor patch referenced by the SecurityFocus BID 505 entry, or upgrade IMail Service to a fixed release.
- If patching is not possible, restrict network access to the IMail service to trusted hosts only.
- Run the IMail service with least privilege so a successful overflow cannot easily lead to full host compromise.
- Monitor the service for crashes and restart it under a supervised process to limit denial-of-service windows.
Detection
- Monitor IMail service logs and host event logs for repeated crashes or abnormal process termination.
- Inspect HTTP or service request logs for unusually long URLs or oversized request lines targeting the IMail service.
- Watch for unexpected child processes or command execution spawned by the IMail service process.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-1999-1551 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-1999-1551), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
