AOH :: HP Unsorted S :: BX2495.HTM

Surgemail 38k4 IMAP server remote stack overflow



: Surgemail 38k4 IMAP server remote stack overflow
: Surgemail 38k4 IMAP server remote stack overflow



                                            
                  INFIGO IS Security Advisory #ADV-2008-03-07
http://www.infigo.hr/en/ 




Title: Surgemail 38k4 IMAP server remote stack overflow
Advisory ID: INFIGO-2008-03-07
Date: 2008-03-21
Advisory URL: http://www.infigo.hr/en/in_focus/advisories/INFIGO-2008-03-07 
Impact: Remote code execution
Risk Level: High
Vulnerability Type: Remote




==[ Overview

SurgeMail Mail Server Software Suite - combines advanced features, high
performance and ease of use. Works on Windows, UNIX (Linux, Solaris etc.),
Mac OSX, FreeBSD and others. Surgemail integrated email server is an
Antispam Server, Antivirus Server, Webmail Server, Groupware Server, 
Blog Server and much more. 



==[ Vulnerability

A remote vanilla stack overflow vulnerability exists in the Surgemail IMAP 
server. The vulnerability is caused due to a boundary error in the IMAP 
server, when processing overly long arguments of the 'LSUB' command.
The vulnerability results in a simple stack overflow condition that can be
trivially exploited.

Example:
a002 LSUB "//AA:" * 12000 + " " + "//AA:" * 21000 + "\r\n"



==[ Affected Version

The vulnerability has been identified in the latest available 38k4-4. 
It was tested on Windows XP SP2.



==[ Fix

The vendor released a new version that fixes the vulnerability available at
http://www.netwinsite.com/surgemail/. 



==[ PoC Exploit

http://www.infigo.hr/files/surgemail.pl 



==[ Vendor status

01.09.2008 - Initial contact
01.10.2008 - Initial vendor response
03.19.2008 - Vendor status update - Patch available
03.21.2008 - Coordinated public disclosure



==[ Credits

Vulnerability discovered by Leon Juranic . 



==[ INFIGO IS Security Contact

INFIGO IS,

WWW : http://www.infigo.hr/en/ 
E-mail : infocus@infigo.hr 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.