CSM Mail Server vulnerable to a DoS attack (long HELO)
29 Dec. 1999
Summary
CSM Mail, an SMTP server for Windows 95/98/NT, is vulnerable to a buffer overflow which is caused by sending a long HELO command. Remote attackers can easily exploit this to perform a Denial of Service attack against the CSM Mail server.
Credit:
The information was provided by: Ussr Labs.
Vulnerable systems:
CSM Mail Server 2000-01A
CSM Mail Server 1999-07M
CSM Mail Server 1999-07I
CSM Mail Server 1999-07H
CSM Mail Server 1999-07G
CSM Mail Server 1999-07F
CSM Mail Server 1999-07b
UssrLabs found a Local / Remote Buffer overflow, which could also lead to the possibility of executing arbitrary code, the overflow is caused by a (long HELO) in the login procedure.
Example:
$ telnet example.com 25
Trying example.com...
Connected to example.com.
Escape character is '^]'.
220 SMTP CSM Mail Server ready at ServerName.com (Version 2000.08.A - NT.4.0.1381) helo [buffer]
Where [buffer] is approximately 12000 characters. At his point the server overflows and crashes.
