full-disclosure - Axigen server version: 2.0.0-beta1 (Linux/i686)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <a37d3d6d0702160551l1753a209pa8273bb4aba667ef@mail.gmail.com>
Date: Fri, 16 Feb 2007 13:51:34 +0000
From: fugich <fugich@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Axigen server version: 2.0.0-beta1 (Linux/i686) -
	pop3 remote shell

The code attached exploits a format string vulnerability in the V2 beta
version of Axigen.

The pop3 service calls syslog in a vulnerable way when the logtype, for the
pop3 service, been set to "system" and loglevel is number with 4th bit set.
Any unknown command causes the log call with overwriting consequences.

This problem is patched in the final release but I am informed that v1 is
vulnerable, couldn't get my hands on the binary to test though

Thanks to mu-b

Have fun

fuGich

Content of type "text/html" skipped

View attachment "axiagen.c" of type "text/x-csrc" (6119 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/