InstantServer ISMail Remote User Fields Buffer Overflow Vulnerability

Bugtraq ID:	6972
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 27 2003 12:00AM
Updated:	Feb 27 2003 12:00AM
Credit:	Discovery credited to NGSSoftware Insight Security Research.
Vulnerable:	InstantServers ISMail 1.4.3
Not Vulnerable:	InstantServers ISMail 1.4.5

InstantServer ISMail Remote User Fields Buffer Overflow Vulnerability

It has been reported that ISMail does not properly handle long strings under some circumstances. When an email containing specifically crafted strings in various fields of the email header is passed through the server, a buffer overflow occurs. This could be exploited to execute code on vulnerable server.

InstantServer ISMail Remote User Fields Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

InstantServer ISMail Remote User Fields Buffer Overflow Vulnerability

Solution:
It has been reported by NGSSoftware that the following vendor fix resolves this issue:


InstantServers ISMail 1.4.3

• InstantServers ism145.exe
  http://instantservers.com/download/ism145.exe

InstantServer ISMail Remote User Fields Buffer Overflow Vulnerability

References:

• ISMAIL (All Versions) Remote Buffer Overrun ("NGSSoftware Insight Security Research" )