lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 10 Aug 2007 16:28:42 +1200
From: Harmony Security Advisory <>
Subject: [HS-A007] Qbik WinGate Remote Denial of Service

[HS-A007] Qbik WinGate Remote Denial of Service

10 August 2007

Affected Software
WinGate versions 5.x and 6.x (prior to 6.2.2).

WinGate by  Qbik IP  Management Limited  is a  sophisticated gateway and
server product  used in  over 600,000  networks across  the globe.  More
information about WinGate can be found here:

WinGate provides a number of  network services including an SMTP  server
for email.  It is  this SMTP  server component  that is  vulnerable to a
remotely  exploitable format  string vulnerability  that can  lead to  a
remote  DoS  attack,  resulting  in  the  entire  WinGate  service being
terminated. The result of the WinGate service being terminated in such a
fashion is that none  of the many network  services it provides will  be
available until a manual restart is performed as well as the loss of any
unsaved data.

Vulnerability Description
The vulnerability occurs  as a result  of how the  SMTP server component
handles an incorrectly  established SMTP session  with a client.  Upon a
malicious client initiating a connection to the SMTP server the  session
can be forced into an invalid  state by issuing commands the server  was
not expecting. When this occurs an error message is formatted to log the
problem. It is  in the formatting  of this error  message that malicious
attacker supplied  data is  passed into  an unsafe  call to  vsprintf(),
leading to a  format string attack  that crashes the  process. Arbitrary
code execution cannot be leveraged from this attack.

Qbik have released WinGate version 6.2.2 to address this issue.  Further
information is available here:

Disclosure Timeline
29 June 2007 - Initial vendor notification
29 June 2007 - Initial vendor response
13 July 2007 - Vendor released fix
10 August 2007 - Public Disclosure

This vulnerability was discovered by Stephen Fewer of Harmony Security.


The use of this information constitutes  acceptance for use in an AS  IS
condition. There are no warranties with regard to this information.  Any
use of this information is at the user's own risk. In no event shall the
author  or  publisher  be  liable for  any  direct  or  indirect damages
whatsoever arising out  of or in  connection with the  use or spread  of
this information.

Copyright (c) 2007 Harmony Security

Powered by blists - more mailing lists