CMS Mail Server Buffer Overflow Vulnerabilities
BID:244
Info
CMS Mail Server Buffer Overflow Vulnerabilities
| Bugtraq ID: | 244 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 27 1999 12:00AM |
| Updated: | Apr 27 1999 12:00AM |
| Credit: | This vulnerability was reported to the BUGTRAQ mailing list by pw <[email protected]>. |
| Vulnerable: |
Computer Software Manufaktur CSM Mail Server 1999.7 .D |
| Not Vulnerable: | |
Discussion
CMS Mail Server Buffer Overflow Vulnerabilities
The CMS Mail Server is a SMTP mail server for Windows 95/98 and Windows NT. The program has a number of buffer overflows, at least two of which allow the remote execution of arbitrary code.
One overflows is in the handling of the HELO SMTP command. Another is in the handling of the MAIL FROM SMTP command. Neither of these seems to allow execution of arbitrary code.
Another overflow is in the handling of the VRFY command. When a long string without the '@' symblo is passed as an argument. This overflow can overwrite the return address and allow the execution of arbitrary code. A related overflow in the handling of the VRFY command occurs when the long contains the '@' symbol. This overflow seems not capable of executing arbitrary code.
The handling of the RCPT TO command also contains a similar overflow that allows the execution of arbitrary code.
All earlier version of CMS Mail possibly vulnerable as well.
The CMS Mail Server is a SMTP mail server for Windows 95/98 and Windows NT. The program has a number of buffer overflows, at least two of which allow the remote execution of arbitrary code.
One overflows is in the handling of the HELO SMTP command. Another is in the handling of the MAIL FROM SMTP command. Neither of these seems to allow execution of arbitrary code.
Another overflow is in the handling of the VRFY command. When a long string without the '@' symblo is passed as an argument. This overflow can overwrite the return address and allow the execution of arbitrary code. A related overflow in the handling of the VRFY command occurs when the long contains the '@' symbol. This overflow seems not capable of executing arbitrary code.
The handling of the RCPT TO command also contains a similar overflow that allows the execution of arbitrary code.
All earlier version of CMS Mail possibly vulnerable as well.
Exploit / POC
CMS Mail Server Buffer Overflow Vulnerabilities
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
CMS Mail Server Buffer Overflow Vulnerabilities
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
CMS Mail Server Buffer Overflow Vulnerabilities
References:
References: