SLMail v2.5 POP Service

Seattle Labs SLMail 2.5

Reported October 14, 1997 by David LeBlanc

Systems Affected

Systems Running SLMail 2.5

The Problem

David LeBlanc writes:

Version 2.5 (current version) is vulnerable to a buffer overrun attack on the POP3 service.  If the username supplied is too long, the service will fail with a memory exception.  To the best of our knowledge, there are no current exploits which can cause remote execution, but given the characteristics of the failure, it seems entirely possible that this could occur.  At the very least, it constitutes a denial of service which will require rebooting the server if attacked.  We notified Seattle Lab of this problem two months ago, and they did not seem to understand the severity of the problem.

Stopping the Problem:

Upgrade to version 2.6

Seattle Lab"s Response:

The firms says a fix is available in their SLMail v2.6 located HERE

To learn more about new NT security concerns, subscribe to NTSD.

Credit:
Reported by David LeBlanc
Posted here at NTSecurity.Net October 22, 1997

Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish