bugtraq - SLMail Pro Supervisor Report Center Buffer Overflow (#NISR05022004a)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <009c01c402b3$b7468470$653214ac@GLADIUS>
Date: Fri, 5 Mar 2004 13:13:55 -0000
From: "NGSSoftware Insight Security Research" <nisr@...xgenss.com>
To: <bugtraq@...urityfocus.com>, <NTBUGTRAQ@...TSERV.NTBUGTRAQ.COM>,
	<vulnwatch@...nwatch.org>
Subject: SLMail Pro Supervisor Report Center Buffer Overflow (#NISR05022004a)

NGSSoftware Insight Security Research Advisory

Name: SLMail Pro Supervisor Report Center Buffer Overflow
Systems Affected: SLMail Pro version 2.0.9 and earlier on Windows.
Severity: High Risk
Vendor URL: http://www.slmail.com/
Author: David Litchfield [ david@...software.com ]
Date Vendor Notified:    7th January 2004
Date of Public Advisory: 5th March 2004
Advisory number: #NISR05022004a
Advisory URL: http://www.ngssoftware.com/advisories/slmailsrc.txt

Description
***********
SLMail Pro is a complete e-mail solution designed for the small to medium 
enterprise. A default install of SLMail Pro includes the installation of the 
Supervisor Report Center; this has been found vulnerable to a stack based 
buffer overflow vulnerability.

Details
*******
The Supervisor Report Center is a self-contained web server. The image file 
for the web server is webcontainer.exe and the server HTTP response header 
is returned as "OctoWebSvr/COM". The web server listens on TCP port 801 by 
default. An attacker can trigger the overflow by making an HTTP request and 
providing an overly long HTTP sub-version (HTTP/1.x). This sub-version is 
copied to a stack based buffer and is used in the server's response to the 
client. On overflow the saved return address stored on the stack is 
overwritten allowing the attacker to redirect the process' flow of execution 
and gives the ability to run arbitrary code.

Fix Information
***************
SLMail have made available a patch to resolve this issue: 
http://216.26.170.92/Products/SLMailPro/Utilities.asp . Customers are urged 
to update as soon as is possible.

About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application 
security assessment scanners. Based in the United Kingdom, NGSSoftware have 
offices in the South of London and the East Coast of Scotland. NGSSoftware's 
sister company NGSConsulting, offers best of breed security consulting 
services, specialising in application, host and network security 
assessments.

http://www.ngssoftware.com/

Telephone +44 208 401 0070
Fax +44 208 401 0076

enquiries@...software.com