IA WebMail Server combined with the IA eMailServer is "a powerful combination for remote access. The IA WebMail Server will work with any standard Web browser to allow users access to their email from anywhere on the Internet. Most mail client programs require that they be reconfigured each time they are used by a different user. This feature is a definite boon to any user who travels or works from outside the office on occasion".
The WebMail Server contains a buffer overflow in the HTTP GET request headers. If a page of 1044 bytes is requested, a saved return address on the stack is completely overwritten, and the instruction pointer can be fully controlled upon the execution of a 'retn' instruction. It is also possible to gain control of the ECX register during the process.
At this point, the saved return address has been overwritten, and we are just waiting for the following return instruction.
* Reference To: MFC42.Ordinal:0320, Ord:0320h
:0041DC45 E8F2830000 Call 0042603C
:0041DC4A 8B8C2434040000 mov ecx, dword ptr [esp+00000434]
:0041DC51 5F pop edi
:0041DC52 5E pop esi
:0041DC53 5D pop ebp
:0041DC54 33C0 xor eax, eax
:0041DC56 64890D00000000 mov dword ptr fs:, ecx
:0041DC5D 5B pop ebx
:0041DC5E 81C430040000 add esp, 00000430
:0041DC64 C3 ret ; <- Here we gain control of the EIP
The altered saved return address is pop'ed off the stack instead of the real saved return address.