================================================================================ Delphis Consulting Plc ================================================================================ Security Team Advisories [30/05/2000] securityteam@delphisplc.com [http://www.delphisplc.com/thinking/whitepapers/] ================================================================================ Adv : DST2K0007 Title : Buffer Overrun in ITHouse Mail Server v1.04 Author : DCIST (securityteam@delphisplc.com) O/S : Microsoft Windows NT v4.0 Workstation (SP6) Product : ITHouse Mail Server v1.04 Date : 30/05/2000 I. Description II. Solution III. Disclaimer ================================================================================ I. Description ================================================================================ Delphis Consulting Internet Security Team (DCIST) discovered the following vulnerability in the ITHouse Mail Server under Windows NT. Sending an email via SMTP to an IT House Mail Server with a recipient's name in excess of 2270 bytes causes the IT House Mail Server to buffer overrun overwriting the EIP (2270 + EIP). This could allow an attacker to execute arbitrary code on the the server. Example: HELO example.org MAIL FROM:example@example.org RCPT TO: + EIP DATA . QUIT Wait for the mail delivery routine to start at which point the server will crash executing the arbitrary code. II. Solution ================================================================================ Vendor Status: Informed Currently there is no known solution to this problem. III. Disclaimer ================================================================================ THE INFORMATION CONTAINED IN THIS ADVISORY IS BELIEVED TO BE ACCURATE AT THE TIME OF PRINTING, BUT NO REPRESENTATION OR WARRANTY IS GIVEN, EXPRESS OR IMPLIED, AS TO ITS ACCURACY OR COMPLETENESS. NEITHER THE AUTHOR NOR THE PUBLISHER ACCEPTS ANY LIABILITY WHATSOEVER FOR ANY DIRECT, INDIRECT OR CONSEQUENTIAL LOSS OR DAMAGE ARISING IN ANY WAY FROM ANY USE OF, OR RELIANCE PLACED ON, THIS INFORMATION FOR ANY PURPOSE. ================================================================================