Re: [IMail Forum] IMAP service stopping...

[Matt]

I agree entirely with this statement, however I think that it would be good to point out that Eric is one of the "good guys" and we should be careful to not throw our angst in his direction.  It was the management that screwed us. This seemed to start with the hiring of Jill Jones, Messaging Product Manager, and Alex Neihaus, VP of Marketing, around April of 2004.  The exact direction of the product appears to be Mrs. Jones' responsibility, but there is no way that this could have happened without people like Brian Landrigan (VP of Sales) Authur Beals (CFO) and Roger Greene (CFO) signing off on it. Now of course the official response will be that you can still purchase a maintenance agreement for stand-alone IMail, but this only came about after a week of absolute outrage when Ipswitch initially refused to continue providing the stand-alone product.  There is no doubt that they are only continuing to do so because they would otherwise lose a lot of subscription revenue.  They were so nice when they decided to offer us the ability to pay for maintenance agreements that they only upped the price by 40%.  Apparently you need special permission from your fairy godmother to purchase new stand-alone IMail installations. One of the scariest things that I saw following this debacle was this post by Jill Jones regarding enhancements to Web mail:     http://www.mail-archive.com/imail_forum@list.ipswitch.com/msg95122.html The gist of that message was that it wasn't beyond them to upgrade Web mail for their product, and deny those that have maintenance agreements from having access to it...unless they shelled out thousands of dollars for ICS bloatware.  This wouldn't be so bad if Web mail wasn't severely sub-standard in comparison to almost any offering out there. I have already moved my hosted E-mail over to SmarterMail, but for the time being, I am still using IMail for spam blocking because Declude works best with it.  I expect that to change within the year.  SmarterMail isn't by far a perfect product, but it looks great to my customers due to the much improved Web interface (how else would they judge it), and I'm pretty sure that they don't have some bozos sitting around in a room scheming to replace products with one that is vastly similar, but 1,000% more expensive, and violate maintenance agreements while they are at it, only to concede to continue to take our money in exchange for us bending over for a 40% increase in renewal fees for something that they won't even sell publically. It has been a year now and seemingly nothing has changed.  I hope that people don't pay for maintenance unless they specifically need it just to put a hurt on this company and hopefully force a change, and a heartfelt apology. Matt dstrz wrote: I'm not sure if I am interpreting your reponse correctly. Do you mean... the user's responsibility to keep their existing version up-to-date by applying patches released by Ipswitch to address security vulnerabilities in their software with known exploits in the wild Or the user's responsibility to open their wallet to the tune of $10,000 (give or take) at the software developer's whim, or whenever they decide to change the definition of "current version." Can you clarify? -Dave -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Eric Shanbrom Sent: Friday, August 12, 2005 3:48 PM To: IMail_Forum@list.ipswitch.com Subject: Re: [IMail Forum] IMAP service stopping... A better fix would be to keep IMail up to date. These were addressed in the current version Eric S ----- Original Message ----- From: "dstrz " <[EMAIL PROTECTED]> To: <IMail_Forum@list.ipswitch.com> Sent: Friday, August 12, 2005 12:37 PM Subject: Re: [IMail Forum] IMAP service stopping... FYI - I am running a fully-patched Win2000 server (SP4 & all critical updates) and I got hit this morning with this exploit. Someone crashed the IMAP service and dropped a Trojan (rpcmon.exe) on my server. My HOSTS file was FUBAR and there were 30-or-so TCP ports listening in the 1100-1130 range, presumably for IRC. Fortunately those ports are firewalled to the Internet, but I'm still cleaning up. I modified the IMAP "Hello Message" to remove any reference to "IMail" in a security-through-obscurity act of desperation, but of course the vulnerability still exists. Thanks, Ipswitch! -Dave --------------------------- Re: [IMail Forum] IMAP service stopping... Russ Uhte Tue, 09 Aug 2005 07:56:20 -0700 Bonno Bloksma wrote: Hi, So THAT is the way these trojans are getting into my mailserver... :-(((( Sophos is getting them but I was unable to find the attac vector. That's it. According to the source code, it's only a DoS on Windows 2000 SP2 or greater. On anything prior to that, it actually spawns a reverse shell to the attacker. At that point, you're rooted. If the attacker's smart enough, you'll never be able to clean that machine without a format re-install. Grrrrrrr. So it seesm this bug is only fixed in IMail 8.2 and was never fixed in earlier versions. Might have been nice of Ipswitch to have a BIG warning on their site to tell us about his. I had heard about a buffer overflow in IMail but was unable to verify which parts were vulnerable. I'll be on the phone with them in a few minutes to see what action I need to take. Luckily, I was running SP2 when I got hit, so it was only a DoS for me. I don't have a bunch of people using IMAP, so I just shut the service down completely. Obviously that's not an option for a shop that relies heavily on IMAP. I'm running 8.15, with no plans to upgrade to another version of IMail. I didn't like the way the company was going, and I sure wasn't gonna spend more money for a product I didn't believe in. Let us know what they tell you. People.... there ARE worms loose using this vulnerability to penetrate the mailserver. Sophos reports it as Troj/ServU-Gen. My biggest concern was what if this would have been a POP3 vuln. I would have been toast. I can't take that chance on my server. Therefore, qmail :) Thanks, Russ --- [This E-mail scanned for viruses by Declude Virus] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/