InetServ 3.0 WebMail Long GET Request Vulnerability
BID:949
Info
InetServ 3.0 WebMail Long GET Request Vulnerability
| Bugtraq ID: | 949 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 17 2000 12:00AM |
| Updated: | Jan 17 2000 12:00AM |
| Credit: | Discovered by Greg Hoglund and posted to the NTBugtraq mailling list on jan 17, 2000. |
| Vulnerable: |
A-V Tronics InetServ 3.0 |
| Not Vulnerable: | |
Discussion
InetServ 3.0 WebMail Long GET Request Vulnerability
InetServ is a freeware mail server for 32 bit Windows systems.
One of the features of this program is webmail, which allows mail to be read from any browser. There is an unchecked buffer in the code that parses the GET requests, and a request of 537 bytes or longer will overwrite the EIP register. This overflow can allow arbitrary code to be run on the machine by a remote attacker.
There are also many other unchecked buffers in the code, each of which could potentially be exploited in this manner.
It should be noted that the webmail interface is an optional feature of A-V Tronics InetServ, and is not enabled by default.
InetServ is a freeware mail server for 32 bit Windows systems.
One of the features of this program is webmail, which allows mail to be read from any browser. There is an unchecked buffer in the code that parses the GET requests, and a request of 537 bytes or longer will overwrite the EIP register. This overflow can allow arbitrary code to be run on the machine by a remote attacker.
There are also many other unchecked buffers in the code, each of which could potentially be exploited in this manner.
It should be noted that the webmail interface is an optional feature of A-V Tronics InetServ, and is not enabled by default.
Exploit / POC
InetServ 3.0 WebMail Long GET Request Vulnerability
This exploit will share all drives on the target machine with no password.
This exploit will share all drives on the target machine with no password.
Solution / Fix
InetServ 3.0 WebMail Long GET Request Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
InetServ 3.0 WebMail Long GET Request Vulnerability
References:
References:
- InetServ Home Page (A-V Tronics)
- Remote Buffer Exploit - InetServ 3.0 (NTBugtraq)