From securityteam@DELPHISPLC.COM Mon Jul 10 02:42:47 2000 From: Security Team To: BUGTRAQ@SECURITYFOCUS.COM Date: Thu, 1 Jun 2000 08:43:38 +0100 Subject: DST2K0007: Buffer Overrun in ITHouse Mail Server v1.04 [The following text is in the "iso-8859-1" character set] [Your display is set for the "US-ASCII" character set] [Some characters may be displayed incorrectly] > ========================================================================== > ====== > Delphis Consulting Plc > ========================================================================== > ====== > > Security Team Advisories > [30/05/2000] > > > securityteam@delphisplc.com > [http://www.delphisplc.com/thinking/whitepapers/] > > ========================================================================== > ====== > Adv : DST2K0007 > Title : Buffer Overrun in ITHouse Mail Server v1.04 > Author : DCIST (securityteam@delphisplc.com) > O/S : Microsoft Windows NT v4.0 Workstation (SP6) > Product : ITHouse Mail Server v1.04 > Date : 30/05/2000 > > I. Description > > II. Solution > > III. Disclaimer > > > ========================================================================== > ====== > > > I. Description > ========================================================================== > ====== > > > Delphis Consulting Internet Security Team (DCIST) discovered the following > vulnerability in the ITHouse Mail Server under Windows NT. > > Sending an email via SMTP to an IT House Mail Server with a recipient's > name in > excess of 2270 bytes causes the IT House Mail Server to buffer overrun > overwriting > the EIP (2270 + EIP). This could allow an attacker to execute arbitrary > code on the > the server. > > Example: > HELO example.org > MAIL FROM:example@example.org > RCPT TO: + EIP > DATA > > . > QUIT > > Wait for the mail delivery routine to start at which point the server will > crash > executing the arbitrary code. > > > II. Solution > ========================================================================== > ====== > > Vendor Status: Informed > > Currently there is no known solution to this problem. > > > III. Disclaimer > ========================================================================== > ====== > THE INFORMATION CONTAINED IN THIS ADVISORY IS BELIEVED TO BE ACCURATE AT > THE TIME OF PRINTING, BUT NO REPRESENTATION OR WARRANTY IS GIVEN, EXPRESS > OR > IMPLIED, AS TO ITS ACCURACY OR COMPLETENESS. NEITHER THE AUTHOR NOR THE > PUBLISHER ACCEPTS ANY LIABILITY WHATSOEVER FOR ANY DIRECT, INDIRECT OR > CONSEQUENTIAL LOSS OR DAMAGE ARISING IN ANY WAY FROM ANY USE OF, OR > RELIANCE > PLACED ON, THIS INFORMATION FOR ANY PURPOSE. > ========================================================================== > ======