[security-alerts] FW: [SA21595] MDaemon POP3 Server Buffer Overflow Vulnerabilities

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> TITLE:
> MDaemon POP3 Server Buffer Overflow Vulnerabilities
> 
> SECUNIA ADVISORY ID:
> SA21595
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/21595/
> 
> CRITICAL:
> Moderately critical
> 
> IMPACT:
> System access
> 
> WHERE:
> From local network
> 
> SOFTWARE:
> MDaemon 9.x
> http://secunia.com/product/10271/
> MDaemon 8.x
> http://secunia.com/product/5407/
> 
> DESCRIPTION:
> INFIGO IS has discovered some vulnerabilities in MDaemon, which can
> be exploited by malicious people to compromise a vulnerable system.
> 
> The vulnerabilities are due to boundary errors in the POP3 server and
> can be exploited to cause a heap-based buffer overflow by supplying an
> overly long string to the "USER" or "APOP" command.
> 
> Successful exploitation allows execution of arbitrary code.
> 
> The vulnerabilities have been confirmed in version 9.0.5. Prior
> versions may also be affected.
> 
> SOLUTION:
> Update to version 9.0.6.
> 
> PROVIDED AND/OR DISCOVERED BY:
> Sasa Jusic and Leon Juranic, INFIGO IS
> 
> ORIGINAL ADVISORY:
> http://www.infigo.hr/en/in_focus/advisories/INFIGO-2006-08-04
>