IMail IMonitor status.cgi DoS Vulnerability
BID:914
Info
IMail IMonitor status.cgi DoS Vulnerability
| Bugtraq ID: | 914 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jan 05 2000 12:00AM |
| Updated: | Jan 05 2000 12:00AM |
| Credit: | Discovered and publicized by USSR Labs on January 5, 1999 |
| Vulnerable: |
Ipswitch IMail 6.1 Ipswitch IMail 6.0 Ipswitch IMail 5.0.8 |
| Not Vulnerable: | |
Discussion
IMail IMonitor status.cgi DoS Vulnerability
IMail includes a service called IMail Monitor which is used for local and remote performance measuring and diagnostics. It includes a small webserver operating on port 8181 to support web-based monitoring. One of the cgi scripts, status.cgi, is used to determine which services are currently running and create a web pafge to report this information. Multiple simultaneous requests for status.cgi will cause the software to crash, with a Dr. Watson error of "Invalid Memory Address".
IMail includes a service called IMail Monitor which is used for local and remote performance measuring and diagnostics. It includes a small webserver operating on port 8181 to support web-based monitoring. One of the cgi scripts, status.cgi, is used to determine which services are currently running and create a web pafge to report this information. Multiple simultaneous requests for status.cgi will cause the software to crash, with a Dr. Watson error of "Invalid Memory Address".
Exploit / POC
IMail IMonitor status.cgi DoS Vulnerability
dieimail.exe - binary
dieimail.zip - source
dieimail.exe - binary
dieimail.zip - source
Solution / Fix
IMail IMonitor status.cgi DoS Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].