bugtraq - Re: IpSwitch IMAP Server LOGON stack overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <D5B627B977E64A5AB0E3515971C1EF6.MAI@moststable.com>
Date: Wed, 8 Jun 2005 16:55:33 -0400
From: <nolimit@...eiso.org>
To: <dave@...unitysec.com>
Cc: Full-Disclosure@...ts.grok.org.uk, vulnwatch@...nwatch.org,
	bugtraq@...urityfocus.com
Subject: Re: IpSwitch IMAP Server LOGON stack overflow

Ah, you refer to this one.
"The first vulnerability specifically exists in the handling of a long 
username to the LOGIN command. A long username argument of approximately 
2,000 bytes will cause a stack based unicode string buffer overflow 
providing the attacker with partial control over EIP. As this 
vulnerability is in the LOGIN command itself, valid credentials are not 
required. "

Later it reads 
"The second vulnerability also exists in the handling of the LOGIN 
command username argument, however it lends itself to easier 
exploitation."

I guess I shouldn't have trusted this statement :) 
Perhaps I'll take a look at this one next, or just use your CANVAS example :)
Cheers
nolimit

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/