Infinite InterChange Denial of Service Vulnerability

Bugtraq ID:	2140
Class:	Boundary Condition Error
CVE:	CVE-2001-0097
Remote:	Yes
Local:	Yes
Published:	Dec 21 2000 12:00AM
Updated:	Jul 11 2009 04:46AM
Credit:	Discovered and posted to Bugtraq on Dec 21, 2000 by SNS Research <[email protected]>.
Vulnerable:	Infinite Interchange 3.61 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:

Infinite InterChange Denial of Service Vulnerability

Infinite Interchange is a multi function email server which supports most common internet protocols. An example of various functions include an http server and webmail interface.

Unfortunately Interchange is subject to a denial of service. By requesting a malformed POST command to the HTTP server port comprised of approx 963 bytes, Interchange will crash. A restart of the service is required in order to gain normal functionality.

This vulnerability may be the result of a buffer overflow, although not verified this could lead to the execution of arbitrary code on the target host.

Infinite InterChange Denial of Service Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Infinite InterChange Denial of Service Vulnerability

References:

• Interchange Product Homepage (Infinite)