[34043] in bugtraq
SLMail Pro Supervisor Report Center Buffer Overflow (#NISR05022004a)
daemon@ATHENA.MIT.EDU (NGSSoftware Insight Security Resea)
Fri Mar 5 12:44:41 2004
Message-ID: <009c01c402b3$b7468470$653214ac@GLADIUS>
From: "NGSSoftware Insight Security Research" <nisr@ntexgenss.com>
To: <bugtraq@securityfocus.com>, <NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM>,
<vulnwatch@vulnwatch.org>
Date: Fri, 5 Mar 2004 13:13:55 -0000
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-1";
reply-type=original
Content-Transfer-Encoding: 7bit
NGSSoftware Insight Security Research Advisory
Name: SLMail Pro Supervisor Report Center Buffer Overflow
Systems Affected: SLMail Pro version 2.0.9 and earlier on Windows.
Severity: High Risk
Vendor URL: http://www.slmail.com/
Author: David Litchfield [ david@ngssoftware.com ]
Date Vendor Notified: 7th January 2004
Date of Public Advisory: 5th March 2004
Advisory number: #NISR05022004a
Advisory URL: http://www.ngssoftware.com/advisories/slmailsrc.txt
Description
***********
SLMail Pro is a complete e-mail solution designed for the small to medium
enterprise. A default install of SLMail Pro includes the installation of the
Supervisor Report Center; this has been found vulnerable to a stack based
buffer overflow vulnerability.
Details
*******
The Supervisor Report Center is a self-contained web server. The image file
for the web server is webcontainer.exe and the server HTTP response header
is returned as "OctoWebSvr/COM". The web server listens on TCP port 801 by
default. An attacker can trigger the overflow by making an HTTP request and
providing an overly long HTTP sub-version (HTTP/1.x). This sub-version is
copied to a stack based buffer and is used in the server's response to the
client. On overflow the saved return address stored on the stack is
overwritten allowing the attacker to redirect the process' flow of execution
and gives the ability to run arbitrary code.
Fix Information
***************
SLMail have made available a patch to resolve this issue:
http://216.26.170.92/Products/SLMailPro/Utilities.asp . Customers are urged
to update as soon as is possible.
About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware have
offices in the South of London and the East Coast of Scotland. NGSSoftware's
sister company NGSConsulting, offers best of breed security consulting
services, specialising in application, host and network security
assessments.
http://www.ngssoftware.com/
Telephone +44 208 401 0070
Fax +44 208 401 0076
enquiries@ngssoftware.com
