Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
From: SNS Research (vuln-devgreyhack.com)
Date: Sat May 26 2001 - 11:26:10 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Strumpf Noir Society Advisories
    ! Public release !

    -= DynFX POPd Denial of Service Vulnerability =-

    Release date: Saturday, May 26, 2001


    DynFX MailServer is an SMTP and POP3 Server package for the WINNT
    and Win2k platforms.

    This application is available from vendor DynFX Internet Services'
    website: http://www.dynfx.de


    The pop daemon that is part of this package contains a problem in
    the logon function. Due to improper handling of overly long (258
    bytes or more) usernames this can be abused to remotely crash the
    running pop3 service.

    The problem appears to be that, altough this is not apparant from
    the relevant API documentation, Mutex doesn't properly handle the
    unexpectedly long input in below code.

    | strMutex = _T("POP3_") + m_strUser + _T("_Lock");
    | m_pMutex = new CMutex( FALSE, strMutex );

    Applying a check on this through limiting the length of m_srtUser
    fixes this problem.



    Vendor has been notified and has fixed the issue in build 2.10.3604.2
    of this product.

    This was tested against DynFX MailServer 2.10.3595.1, running on
    MS WINNT 4.0.


    Since we feel it should be noted when this is the case as well, we
    would like to thank Daniel Weber of DynFX Internet Services for his
    excellent support of this product. The source of the problem and a
    fix were established within hours of our initial heads-up.


    Free sk8! (http://www.freesk8.org)

    SNS Research is rfpolicy (http://www.wiretrip.net/rfp/policy.html)
    compliant, all information is provided on AS IS basis.

    EOF, but Strumpf Noir Society will return!