A-V Tronics InetServ Webmail Authentication Buffer Overflow Vulnerability

Bugtraq ID:	3224
Class:	Boundary Condition Error
CVE:	CVE-2001-1294
Remote:	Yes
Local:	No
Published:	Aug 22 2001 12:00AM
Updated:	Jul 11 2009 07:56AM
Credit:	This vulnerability was submitted to BugTraq on August 22nd, 2001 by SNS Research <[email protected]>.
Vulnerable:	A-V Tronics InetServ 3.2.1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 95 SR2 - Microsoft Windows 98 SP1 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 A-V Tronics InetServ 3.1.1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 95 SR2 - Microsoft Windows 98 SP1 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 A-V Tronics InetServ 3.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 95 SR2 - Microsoft Windows 98 SP1 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0
Not Vulnerable:	A-V Tronics InetServ 3.2.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 98 SP1 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1

A-V Tronics InetServ Webmail Authentication Buffer Overflow Vulnerability

A-V Tronics InetServ is a freeware server for Microsoft Windows systems. It offers functionality for POP3, SMTP, telnet, webmail and other services.

An exploitable buffer overflow exists in the webmail interface of Inetserver.

The buffer overflow will occur if the Username/Password fields are each filled with an excessive number of bytes(140+). At the very minimum this can cause InetServ to crash, denying whatever services the software has been enabled to provide(telnet, SMTP, POP3, etc.). However, a window of opportunity exists for remote attackers to execute arbitrary code on the host(with the privileges of the server), possibly allowing the attacker to gain local access to the host.

It should be noted that the webmail interface is an optional feature of A-V Tronics InetServ, and is not enabled by default.