QwikMail HELO Command Buffer Overflow Vulnerability

Bugtraq ID:	11989
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 15 2004 12:00AM
Updated:	Dec 15 2004 12:00AM
Credit:	Discovery is credited to Jonathan Rockway.
Vulnerable:	Amir Malik QwikMail 0.3
Not Vulnerable:

QwikMail HELO Command Buffer Overflow Vulnerability

QwikMail (qwik-smtpd) is reported prone to a remotely exploitable buffer overflow vulnerability. The issue is due to insufficient bounds checking of client-supplied SMTP HELO request data.

This issue could theoretically be exploited to execute arbitrary code. Due to the memory layout, it is also reportedly possible to overwrite an adjacent buffer in a manner that will allow a remote attacker to abuse the server as an unauthorized mail relay.

QwikMail HELO Command Buffer Overflow Vulnerability

The following example demonstrating how to exploit the issue to relay messages was submitted:

HELO AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA127.0.0.1

QwikMail HELO Command Buffer Overflow Vulnerability

Solution:
It is reported that the vulnerability is addressed in CVS. Symantec has not confirmed this report.

---
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

QwikMail HELO Command Buffer Overflow Vulnerability

References:

• [remote] [exhaust] qwik-smtpd overflows clientHelo buffer ("D. J. Bernstein" )
  
• QwikMail Home Page (Amir Malik)