SLMail Pro Supervisor Report Center Buffer Overflow (#NISR05022004a)
From: NGSSoftware Insight Security Research (nisr_at_NTEXGENSS.COM)
Date: Fri, 5 Mar 2004 13:13:55 -0000 To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
NGSSoftware Insight Security Research Advisory
Name: SLMail Pro Supervisor Report Center Buffer Overflow
Systems Affected: SLMail Pro version 2.0.9 and earlier on Windows.
Severity: High Risk
Vendor URL: http://www.slmail.com/
Author: David Litchfield [ email@example.com ]
Date Vendor Notified: 7th January 2004
Date of Public Advisory: 5th March 2004
Advisory number: #NISR05022004a
Advisory URL: http://www.ngssoftware.com/advisories/slmailsrc.txt
SLMail Pro is a complete e-mail solution designed for the small to medium
enterprise. A default install of SLMail Pro includes the installation of the
Supervisor Report Center; this has been found vulnerable to a stack based
buffer overflow vulnerability.
The Supervisor Report Center is a self-contained web server. The image file
for the web server is webcontainer.exe and the server HTTP response header
is returned as "OctoWebSvr/COM". The web server listens on TCP port 801 by
default. An attacker can trigger the overflow by making an HTTP request and
providing an overly long HTTP sub-version (HTTP/1.x). This sub-version is
copied to a stack based buffer and is used in the server's response to the
client. On overflow the saved return address stored on the stack is
overwritten allowing the attacker to redirect the process' flow of execution
and gives the ability to run arbitrary code.
SLMail have made available a patch to resolve this issue:
http://18.104.22.168/Products/SLMailPro/Utilities.asp . Customers are urged
to update as soon as is possible.
NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware have
offices in the South of London and the East Coast of Scotland. NGSSoftware's
sister company NGSConsulting, offers best of breed security consulting
services, specialising in application, host and network security
Telephone +44 208 401 0070
Fax +44 208 401 0076
NTBugtraq Editor's Note:
Want to reply to the person who sent this message? This list is configured such that just hitting reply is going to result in the message coming to the list, not to the individual who sent the message. This was done to help reduce the number of Out of Office messages posters received. So if you want to send a reply just to the poster, you''ll have to copy their email address out of the message and place it in your TO: field.