Seattle Labs SLMail 2.5
Reported October 14, 1997 by David LeBlanc
Systems
Affected
Systems Running SLMail 2.5
The
Problem
David LeBlanc writes:
Version 2.5 (current version) is vulnerable to a buffer overrun attack on the POP3 service. If the username supplied is too long, the service will fail with a memory exception. To the best of our knowledge, there are no current exploits which can cause remote execution, but given the
characteristics of the failure, it seems entirely possible that this could occur. At the very least, it constitutes a denial of service which will require rebooting the server if attacked. We notified Seattle Lab of this problem two months ago, and they did not seem to understand the severity of the problem.
Stopping the Problem:
Upgrade to version 2.6
Seattle Lab"s Response:
The firms says a fix is available in their SLMail v2.6 located HERE
To learn more about new NT security concerns,
subscribe to NTSD.
Credit:
Reported by David LeBlanc
Posted here at NTSecurity.Net October 22, 1997
|