| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <BAEFKJBBCIPAKCGNHICFAEFNHAAA.kruse@krusesecurity.dk> From: kruse at krusesecurity.dk (Peter Kruse) Subject: Remote DoS in GFI MailEssentials due to a bug in Microsoft HTML parser CSIS Security Advisory: [CSIS2005-1) Remote DoS in GFI MailEssentials due to a bug in Microsoft HTML parser Date Published: 3rd of January 2005 Product description: GFI MailEssentials for Exchange/SMTP offers spam protection and email management at server level. GFI MailEssentials offers a fast set-up and a high spam detection rate using Bayesian analysis and other methods - no configuration required, very low false positives through its automatic whitelist, and the ability to automatically adapt to your email environment to constantly tune and improve spam detection. GFI MailEssentials also adds email management tools to your mail server: disclaimers, mail archiving and monitoring, Internet mail reporting, list server, server-based auto replies and POP3 downloading. Summary: Specially crafted HTML emails could cause GFI MailSecurity and GFI MailEssentials to stop processing, with emails getting stuck in the IIS queue or Exchange pre-submission queues. There will be no error indications other than MailQueue stops processing. Restarting the server or services will not help. The flaw will occur when MailEssentials processes the strings in an email subject, body or in an attached text file. Exploitation is trivial. Vulnerability Class: This flaw affects all tested versions of GFI MailEssentials and will cause a remote Denial of Service. Not tested are other programs making use of Microsoft HTML parser. Details: CSIS has discovered a flaw in GFI MailEssentials 9 and 10.x and GFI MailSecurity 8.x where a specially crafted HTML email causes the products to stop processing, resulting in emails getting stuck in the IIS/Exchange queues. The problem lies in a Microsoft HTML library that is made use of by a GFI library, common to GFI MailSecurity and GFI MailEssentials. A malicious user can exploit this flaw and craft an e-mail containing a specially crafted javascript. When the e-mail containing the javascript is received by MailEssentials, it will be processed resulting in a DoS. The mail will reside in the queues until it's manually removed. If the server is rebooted without removing the affected mail from the queues, the same mail gets processed again and again and a new DoS will occur. MailEssentials will not process any other in- or outbound e-mails until this mail is completely removed from the bad mail queue. This is a ugly scenario since you'll end up looking for a needle in a haystack. CSIS would like to underline that this flaw is really a result of a bug in Microsoft HTML parser. As such, this problem is not directly related to GFI. We suspect other products are vulnerable as well. Impact: Medium-High: This is a remote DoS. Leaving no trace, no warnings and no indication of which e-mail causing the problem. Solution: A fix has been released: GFI MailEssentials 10.x - ftp://ftp.gfi.com/patches/ME10_PATCH_20041220_01.zip GFI MailEssentials 9 - ftp://ftp.gfi.com/patches/me9_PATCH_20041220_01.zip GFI MailSecurity 8.x - ftp://ftp.gfi.com/patches/MSEC8_PATCH_20041220_01.zip It's strongly recommended to apply these patches as soon as possible. Also it would be wise to set up an alert mechanism monitoring number of mails in queue. CSIS also recommend using the GFI monitor function to see if mails gets processed at regular intervals. Affected Products: GFI MailSecurity 8.x GFI MailEssentials 9 GFI MailEssentials 10.x Running on Microsoft Windows 2000 Server with all relevant patches installed. CSIS would like to thank GFI for a quick and professional response. It took only 5 days for GFI to troubleshoot and fix this issue! CVE: The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2004-1312 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. Links For more information about the patches see GFI KB article: http://kbase.gfi.com/showarticle.asp?id=KBID002249 --- Med venlig hilsen // Kind regards Peter Kruse Security- and virusanalyst http://www.csis.dk PGP fingerprint 79FD 0648 158E 6B9E 236F CFDA 7C58 64D6 BE83 FA60
Powered by blists - more mailing lists