SLMail v2.5 POP Service

Seattle Labs SLMail 2.5

Reported October 14, 1997 by David LeBlanc

Systems Affected

Systems Running SLMail 2.5

The Problem

David LeBlanc writes:

Version 2.5 (current version) is vulnerable to a buffer overrun attack on the POP3 service.  If the username supplied is too long, the service will fail with a memory exception.  To the best of our knowledge, there are no current exploits which can cause remote execution, but given the characteristics of the failure, it seems entirely possible that this could occur.  At the very least, it constitutes a denial of service which will require rebooting the server if attacked.  We notified Seattle Lab of this problem two months ago, and they did not seem to understand the severity of the problem.