eXtremail Remote Format String Vulnerability

Bugtraq ID:	2908
Class:	Input Validation Error
CVE:	CVE-2001-1078 CVE-2007-5467
Remote:	Yes
Local:	No
Published:	Jun 21 2001 12:00AM
Updated:	Oct 26 2007 09:36PM
Credit:	Discovered by mu-b <[email protected]>.
Vulnerable:	eXtremail eXtremail 2.1.1 eXtremail eXtremail 1.5.9 eXtremail eXtremail 1.5 -8 eXtremail eXtremail 1.5 -5 eXtremail eXtremail 1.5 eXtremail eXtremail 1.1.9 eXtremail eXtremail 1.1.8 eXtremail eXtremail 1.1.7 eXtremail eXtremail 1.1.6 eXtremail eXtremail 1.1.5 eXtremail eXtremail 1.1.4 eXtremail eXtremail 1.1.3 eXtremail eXtremail 1.1.2 eXtremail eXtremail 1.1.1 eXtremail eXtremail 1.1 eXtremail eXtremail 1.0.3 eXtremail eXtremail 1.0.2 eXtremail eXtremail 1.0.1 eXtremail eXtremail 1.0 eXtremail eXtremail 2.1
Not Vulnerable:	eXtremail eXtremail 1.1.10

eXtremail Remote Format String Vulnerability

eXtremail is a freeware SMTP server available for Linux and AIX.

eXtremail contains a format-string vulnerability in its logging mechanism. Attackers can send SMTP commands argumented with maliciously constructed arguments that will exploit this vulnerability.

eXtremail runs with root privileges. By exploiting this vulnerability, remote attackers can gain superuser access on the underlying host and can crash eXtremail. If the system is not restarted automatically, a denial of SMTP service will result.

UPDATE (April 26, 2004): Reportedly, this vulnerability has been reintroduced into the new version (1.5.9) of eXtremail.

UPDATE (October 26, 2007): Reports indicate that the 'USER' command of eXtremail 2.1.1 and prior is still vulnerable. Symantec has not confirmed this.

eXtremail Remote Format String Vulnerability

References:

• eXtremail Homepage (eXtremail)
  
• Remote Format String Vulnerabilities in eXtremail (Luca Ercoli )