[NT] Buffer Overflows Found in SH39's MailServer

From: support@securiteam.com
Date: 03/10/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Sun, 10 Mar 2002 09:17:32 +0100 (CET)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  Buffer Overflows Found in SH39's MailServer
------------------------------------------------------------------------

SUMMARY

MailServer by <http://www.sh39.net> sh39.net is an SMTP/POP3 e-mail
server. A buffer overflow vulnerability in the product allows attackers
crash the server remotely.

DETAILS

Vulnerable systems:
SH39 MailServer version 1.21

Immune systems:
SH39 MailServer version 1.22

The MailServer crashes when it receives a large string on port 25.
Connecting to the port with telnet and sending about 2500 characters
should do the trick.

Or from a UNIX shell with netcat (nc) installed do the following:
Set your "evil buffer" string
In this case that will be 5000 A's

$ BUF=`perl -e '{print "A"x5000}'`

Echo the buffer and pipe it to the remote host running your MailServer (in
this case 192.168.10.10) In this example we used the "helo" command with a
5000 character counting string attached as value.

$ echo helo $BUF | nc 192.168.10.10

If you look at your MailServer now, it reports an error (Under windows XP)
and the MailServer crashes. Under Windows2000 it just simply does not
respond anymore, the socket is closed and it stops functioning, a
MailServer restart is necessary to regain operational status.

Vendor status:
The vendor was notified a long time ago and has since updated the package
to version 1.22 where everything should be fixed.

ADDITIONAL INFORMATION

The information has been provided by <mailto:Rense.Buijen@dct-mail.com>
Rense Buijen.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • Re: Send email error : could not access cdo.message object.
    ... Sub SendMail(ByVal mailFrom As String, ... ByVal mailServer As String, _ ...
    (microsoft.public.dotnet.general)
  • Re: smtp greeting string
    ... Is there any way to change the smtp greeting string? ... When I set up a telnet session on port 25 to my mailserver I receive type, ...
    (microsoft.public.exchange.setup)
  • Buffer Overflows in sh39.coms mailserver 1.21
    ... I downloaded a copy "mailserver" from your website ... I suspect that you have not applied proper buffer checking ... The mailserver crashes when receiving a large string on port ... The vendor was notified a long time ago and has sins updated his package ...
    (Bugtraq)
  • Buffer Overflows in sh39.coms mailserver 1.21
    ... I downloaded a copy "mailserver" from your website ... I suspect that you have not applied proper buffer checking ... The mailserver crashes when receiving a large string on port ... The vendor was notified a long time ago and has sins updated his package ...
    (Vuln-Dev)