From: Secunia Security Advisories (sec-advsecunia.com)
Date: Mon May 12 2003 - 06:56:12 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

TITLE:
CMailServer "MAIL FROM:" and "RCPT TO:" Buffer Overflows

READ ONLINE:
http://www.secunia.com/advisories/8761/

CRITICAL:
Highly critical

IMPACT:
DoS, System access

WHERE:
From remote

SOFTWARE:
CMailServer 4.x

DESCRIPTION:
Two vulnerabilities have been identified in CMailServer, which can be
exploited by malicious people to cause a DoS (Denial of Service) or
compromise a vulnerable server.

The vulnerabilities are caused due to boundary errors in the handling
of the "MAIL FROM:" and "RCPT TO:" commands. A malicious person can
exploit this by supplying a long, specially crafted argument to the
vulnerable commands, which will result in a buffer overflow.

Successful exploitation will potentially allow execution of arbitrary
code with SYSTEM privileges.

SOLUTION:
Update to version 4.0.2003.03.30 or later:
http://www.youngzsoft.net/cmailserver/cmailsetup.exe

REPORTED BY / CREDITS:
Dennis Rand, Infowarfare.dk.

ORIGINAL ADVISORY:
http://www.infowarfare.dk/Advisories/iw-17-advisory.txt

----------------------------------------------------------------------

Secunia recommends that you verify all advisories you receive, by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

Contact details:
Web : http://www.secunia.com/
E-mail : supportsecunia.com
Tel : +44 (0) 20 7016 2693
Fax : +44 (0) 20 7637 0419

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]