NetCPlus SmartServer3 POP Buffer Overflow Vulnerability

Bugtraq ID:	790
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Nov 11 1999 12:00AM
Updated:	Nov 11 1999 12:00AM
Credit:	Released November 11, 1999 in a Bindview security advisory.
Vulnerable:	NetcPlus SmartServer3 3.5.1 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:	NetcPlus SmartServer3 3.7 x - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 NetcPlus SmartServer3 3.6 x - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0

NetCPlus SmartServer3 POP Buffer Overflow Vulnerability

The POP server that is part of the NetcPlus SmartServer3 email server has an unchecked buffer that could allow an attacker to execute code on the server. If the USER command is followed by an argument of over 800 characters, the input buffer will be overflowed, and data from the argument will be passed to the system to be executed at the privelege level of the SmartServer program.

NetCPlus SmartServer3 POP Buffer Overflow Vulnerability

Exploit written and submitted to bugtraq by Ussr Labs <[email protected]>. This exploit will open a command shell bound to port 666 and restart the POP server.

• /data/vulnerabilities/exploits/SS351EXP.ZIP

NetCPlus SmartServer3 POP Buffer Overflow Vulnerability

Solution:
SmartServer 3.6 and later is not vulnerable to this issue. The latest version of SmartServer is available from:
http://www.netcplus.com/smartserver.htm

NetCPlus SmartServer3 POP Buffer Overflow Vulnerability

References:

• SmartServer3 Homepage (NetcPlus)