BID:2526

Inframail Post Remote Denial of Service Vulnerability

Info

Inframail Post Remote Denial of Service Vulnerability

Bugtraq ID:	2526
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 27 2001 12:00AM
Updated:	Mar 27 2001 12:00AM
Credit:	Reported to bugtraq by SNS Research <[email protected]> on Tue, 27 Mar 2001
Vulnerable:	Infradig Inframail 3.97 a Infradig Inframail 3.96 Infradig Inframail 3.94 a r3.95 Infradig Inframail 3.94 a Infradig Inframail 3.93 a Infradig Inframail 3.92 Infradig Inframail 3.91 Infradig Inframail 3.89 Infradig Inframail 3.88 r 3.90a Infradig Inframail 3.87 a Infradig Inframail 3.87 Infradig Inframail 3.85 Infradig Inframail 3.84 Infradig Inframail 3.83 b Infradig Inframail 3.82 b Infradig Inframail 3.81 a Infradig Inframail 3.80 a

Not Vulnerable:	Infradig Inframail 3.99 Infradig Inframail 3.98 a

Discussion

Inframail Post Remote Denial of Service Vulnerability

An invalid POST command submitted to Inframail, containing a large sequence of characters, can cause an overflow of the relevant buffer and halt the process.

This halts the server and requires a restart to restore functionality.

Exploit / POC

Inframail Post Remote Denial of Service Vulnerability

x

Solution / Fix

Inframail Post Remote Denial of Service Vulnerability

Solution:
Vendor has been notified and has corrected this issue. A new release (v3.98a) of this product has been made available from the vendor's website.

Infradig Inframail 3.80 a