OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: [NEWS] XMail vulnerable to a remotely exploitable buffer overflow (APOP, USER)
From: Aviram Jenik (aviramBEYONDSECURITY.COM)
Date: Wed Sep 06 2000 - 16:11:21 CDT

The following security advisory is sent to the securiteam mailing list, and
can be found at the SecuriTeam web site: http://www.securiteam.com

XMail vulnerable to a remotely exploitable buffer overflow (APOP, USER)
---------------------------------------------------------------------------- 

----

SUMMARY

 <http://www.maticad.it/davide/xmail.asp> XMail is an Internet and
Intranet mail server featuring an SMTP server, POP3 server, finger server,
multiple domains, and more. XMail's parsing function does not perform
proper bound checking when parsing the APOP and USER commands, and this
allows a remote attacker to execute arbitrary code by issuing a long APOP
or USER commands.

DETAILS

Vulnerable systems:
XMail version prior to 0.59

Immune systems:
XMail version 0.59

By issuing standard POP3 commands to the XMail POP3 server it is possible
to cause it to overflow an internal buffer, thus causing it to execute
arbitrary code.

For example, after you connect to an XMail POP server, sending any of the
commands:
USER [a buffer of over 256 characters]
APOP [a buffer of over 256 characters] [a buffer of over 256 characters]

will crash the server. If the buffer is properly crafted, arbitrary code
can be executed.

Patch:
A patched version can be downloaded from:
http://www.maticad.it/davide/xmail.asp

ADDITIONAL INFORMATION

The security hole was discovered by Beyond Security's SecuriTeam
(expertsecuriteam.com).

====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
====================

--
Aviram Jenik
Beyond Security Ltd.
http://www.BeyondSecurity.com
http://www.SecuriTeam.com