Rockliffe MailSite 4.2.1.0 Buffer Overflow Vulnerability

Bugtraq ID:	1244
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	Yes
Published:	May 24 2000 12:00AM
Updated:	May 24 2000 12:00AM
Credit:	Discovered by Cerberus Security Team <[email protected]> and publicized in a Cerberus Information Security Advisory (CISADV000524a).
Vulnerable:	Rockliffe MailSite 4.2.1 0 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0
Not Vulnerable:

Rockliffe MailSite 4.2.1.0 Buffer Overflow Vulnerability

Remote users are able to execute arbitrary code with system privileges by exploiting a buffer overflow vulnerability that exists in the code that handles GET requests in Rockliffe MailSite 4.2.1.0. Performing a GET request containing a query string consisting of over 240 KB will allow for the execution of arbitrary code.

Rockliffe MailSite 4.2.1.0 Buffer Overflow Vulnerability

see discussion

Rockliffe MailSite 4.2.1.0 Buffer Overflow Vulnerability

Solution:
Rockliffe has rectified this vulnerability with the release of MailSite 4.2.2 which is available for download at their website:

http://www.rockliffe.com

Rockliffe MailSite 4.2.1.0 Buffer Overflow Vulnerability

References:

• MailSite Product Home Page (Rockliffe)