From: "infocus" <infocus@infigo.hr.>
To: <bugtraq@securityfocus.com.>
Subject: [INFIGO-2008-03-07]: Surgemail 38k4 IMAP server remote stack overflow
Date: Fri, 21 Mar 2008 10:07:42 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1807
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1807
X-Virus-Scanned: antivirus-gw at tyumen.ru
INFIGO IS Security Advisory #ADV-2008-03-07
http://www.infigo.hr/en/
Title: Surgemail 38k4 IMAP server remote stack overflow
Advisory ID: INFIGO-2008-03-07
Date: 2008-03-21
Advisory URL: http://www.infigo.hr/en/in_focus/advisories/INFIGO-2008-03-07
Impact: Remote code execution
Risk Level: High
Vulnerability Type: Remote
==[ Overview
SurgeMail Mail Server Software Suite - combines advanced features, high
performance and ease of use. Works on Windows, UNIX (Linux, Solaris etc.),
Mac OSX, FreeBSD and others. Surgemail integrated email server is an
Antispam Server, Antivirus Server, Webmail Server, Groupware Server,
Blog Server and much more.
==[ Vulnerability
A remote vanilla stack overflow vulnerability exists in the Surgemail IMAP
server. The vulnerability is caused due to a boundary error in the IMAP
server, when processing overly long arguments of the 'LSUB' command.
The vulnerability results in a simple stack overflow condition that can be
trivially exploited.
Example:
a002 LSUB "//AA:" * 12000 + " " + "//AA:" * 21000 + "\r\n"
==[ Affected Version
The vulnerability has been identified in the latest available 38k4-4.
It was tested on Windows XP SP2.
==[ Fix
The vendor released a new version that fixes the vulnerability available at
http://www.netwinsite.com/surgemail/.
==[ PoC Exploit
http://www.infigo.hr/files/surgemail.pl
==[ Vendor status
01.09.2008 - Initial contact
01.10.2008 - Initial vendor response
03.19.2008 - Vendor status update - Patch available
03.21.2008 - Coordinated public disclosure
==[ Credits
Vulnerability discovered by Leon Juranic <leon.juranic@infigo.hr.>.
==[ INFIGO IS Security Contact
INFIGO IS,
WWW : http://www.infigo.hr/en/
E-mail : [email protected]
