DynFX MailServer Lets Remote Users Crash the POP3 Server
|
|
SecurityTracker Alert ID: 1001634 |
|
SecurityTracker URL: http://securitytracker.com/id/1001634
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: May 29 2001
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
Version(s): Testd on DynFX MailServer 2.10.3595.1, running on MS WINNT 4.0.
|
Description:
SNS Research discovered a vulnerability in the DynFX Mail Server that allows remote users to cause the mail server to crash.
It is reported that the POP3 mail server does not properly handle long user names of 258 bytes or more and will crash if presented with an overly long user name.
|
Impact:
A remote user can cause the mail server to crash.
|
Solution:
The vendor has reportedly fixed the issue in build 2.10.3604.2.
|
Vendor URL: www.dynfx.de/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Windows (NT), Windows (2000)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Sat, 26 May 2001 18:26:10 +0200
Subject: DynFX POPd Denial of Service Vulnerability
|
Strumpf Noir Society Advisories
! Public release !
<--#
-= DynFX POPd Denial of Service Vulnerability =-
Release date: Saturday, May 26, 2001
Introduction:
DynFX MailServer is an SMTP and POP3 Server package for the WINNT
and Win2k platforms.
This application is available from vendor DynFX Internet Services'
website: http://www.dynfx.de
Problem(s):
The pop daemon that is part of this package contains a problem in
the logon function. Due to improper handling of overly long (258
bytes or more) usernames this can be abused to remotely crash the
running pop3 service.
The problem appears to be that, altough this is not apparant from
the relevant API documentation, Mutex doesn't properly handle the
unexpectedly long input in below code.
| strMutex = _T("POP3_") + m_strUser + _T("_Lock");
| m_pMutex = new CMutex( FALSE, strMutex );
Applying a check on this through limiting the length of m_srtUser
fixes this problem.
(..)
Solution:
Vendor has been notified and has fixed the issue in build 2.10.3604.2
of this product.
This was tested against DynFX MailServer 2.10.3595.1, running on
MS WINNT 4.0.
Acknowledgement:
Since we feel it should be noted when this is the case as well, we
would like to thank Daniel Weber of DynFX Internet Services for his
excellent support of this product. The source of the problem and a
fix were established within hours of our initial heads-up.
yadayadayada
Free sk8! (http://www.freesk8.org)
SNS Research is rfpolicy (http://www.wiretrip.net/rfp/policy.html)
compliant, all information is provided on AS IS basis.
EOF, but Strumpf Noir Society will return!
|
|
