Alt-N MDaemon Server SMTP HELO Argument Buffer Overflow Vulnerability

Bugtraq ID:	8622
Class:	Boundary Condition Error
CVE:	CVE-1999-0284
Remote:	Yes
Local:	No
Published:	Mar 10 1998 12:00AM
Updated:	Mar 19 2015 09:24AM
Credit:	Discovery of this vulnerability has been credited to rootshell.com.
Vulnerable:	Alt-N MDaemon 2.71 SP1
Not Vulnerable:

Alt-N MDaemon Server SMTP HELO Argument Buffer Overflow Vulnerability

It has been reported that Alt-N MDaemon server is prone to an SMTP HELO command argument buffer overflow vulnerability.

The issue presents itself likely due to insufficient bounds checking performed when handling malicious SMTP HELO command arguments of excessive length. It has been reported that a remote attacker may exploit this condition to trigger a denial of service in the affected daemon.

Alt-N MDaemon Server SMTP HELO Argument Buffer Overflow Vulnerability

The following proof of concept has been supplied:

• /data/vulnerabilities/exploits/heloexpl.c

Alt-N MDaemon Server SMTP HELO Argument Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Alt-N MDaemon Server SMTP HELO Argument Buffer Overflow Vulnerability

References: