ZMailer SMTP IPv6 HELO Resolved Hostname Buffer Overflow Vulnerability
BID:5592
Info
ZMailer SMTP IPv6 HELO Resolved Hostname Buffer Overflow Vulnerability
| Bugtraq ID: | 5592 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 28 2002 12:00AM |
| Updated: | Aug 28 2002 12:00AM |
| Credit: | Discovery of this issue is credited to 3APA3A <[email protected]>. |
| Vulnerable: |
ZMailer ZMailer 2.99.51 ZMailer ZMailer 2.99.50 ZMailer ZMailer 2.99.49 ZMailer ZMailer 2.99.48 ZMailer ZMailer 2.99.47 ZMailer ZMailer 2.99.46 ZMailer ZMailer 2.99.45 |
| Not Vulnerable: | |
Discussion
ZMailer SMTP IPv6 HELO Resolved Hostname Buffer Overflow Vulnerability
ZMailer is prone to a buffer overflow condition when handling malformed HELO requests originating from IPv6 addresses. In particular, there is a lack of sufficient bounds checking on the Hostname resolved from the IPv6 address. If an attacker can supply overly long values for these fields, it may be possible to trigger the overflow to cause corruption of stack variables and execute arbitrary code with the privileges of the server.
This issue appears to be present in version 2.99.51 and earlier, as reported by FreeBSD. It hasn't been established that this issue is not present in later versions on other platforms.
ZMailer is prone to a buffer overflow condition when handling malformed HELO requests originating from IPv6 addresses. In particular, there is a lack of sufficient bounds checking on the Hostname resolved from the IPv6 address. If an attacker can supply overly long values for these fields, it may be possible to trigger the overflow to cause corruption of stack variables and execute arbitrary code with the privileges of the server.
This issue appears to be present in version 2.99.51 and earlier, as reported by FreeBSD. It hasn't been established that this issue is not present in later versions on other platforms.
Exploit / POC
ZMailer SMTP IPv6 HELO Resolved Hostname Buffer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
ZMailer SMTP IPv6 HELO Resolved Hostname Buffer Overflow Vulnerability
Solution:
ZMailer is included as part of the FreeBSD ports collection. FreeBSD has released a Security Notice FreeBSD-SN-02:05. Users of FreeBSD systems are strongly urged to upgrade their ports tree to fix various reported issues. Further information can be found in the referenced Security Notice.
Solution:
ZMailer is included as part of the FreeBSD ports collection. FreeBSD has released a Security Notice FreeBSD-SN-02:05. Users of FreeBSD systems are strongly urged to upgrade their ports tree to fix various reported issues. Further information can be found in the referenced Security Notice.
References
ZMailer SMTP IPv6 HELO Resolved Hostname Buffer Overflow Vulnerability
References:
References: