full-disclosure - IpSwitch IMAP Server LOGON stack overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <D5B627B977E64A5AB0E3515971C1EF6.MAI@moststable.com>
Date: Wed Jun  8 23:38:07 2005
From: nolimit at coreiso.org (nolimit@...eiso.org)
Subject: IpSwitch IMAP Server LOGON stack overflow

Ah, you refer to this one.
"The first vulnerability specifically exists in the handling of a long 
username to the LOGIN command. A long username argument of approximately 
2,000 bytes will cause a stack based unicode string buffer overflow 
providing the attacker with partial control over EIP. As this 
vulnerability is in the LOGIN command itself, valid credentials are not 
required. "

Later it reads 
"The second vulnerability also exists in the handling of the LOGIN 
command username argument, however it lends itself to easier 
exploitation."

I guess I shouldn't have trusted this statement :) 
Perhaps I'll take a look at this one next, or just use your CANVAS example :)
Cheers
nolimit