eXtremail 2.1.1 - memmove() Remote Denial of Service

eXtremail 2.1.1 - memmove Remote Denial of Service !/usr/bin/perl extremail-v3.pl Copyright c 2006 by eXtremail 1,50 $maxlen = intrand50 + 1; 0, $maxlen 0.75 - 0, $maxlen 0x75 - 1 $pad1len = intrand$maxlen 0.75; 0, $maxlen - $pad1len/2 - 1, $maxlen - $pad1len/2 $pad2len = intrand$maxlen -...

eXtremail 2.1.1 - 'LOGIN' Remote Stack Overflow

/ extremail-v4.c Copyright c 2006 by eXtremail include include include include include define BUFSIZE 8192 define NOP 0x41 define PAD 0 / do you feel lucky? / define DEFPORT 4501 define PORTADMIN DEFPORT define PORTSHELL 4444 static const char bndshelllnx =...

eXtremail 2.1.1 - PLAIN Authentication Remote Stack Overflow

/ extremail-v6.c Copyright c 2006 by eXtremail include include include include include define BUFSIZE 2048 define BBUFSIZE BUFSIZE/34+1 define NOP 0x41 define AUTHCMD "1 AUTHENTICATE PLAIN\n" define DEFPORT 143 define PORTIMAPD DEFPORT define PORTSHELL 4444 static const char movshelllnx =...

Spoofing

eXtremail 2.1.1 and earlier does not verify the ID field aka transaction id in DNS responses, which makes it easier for remote attackers to conduct DNS spoofing...

Stack overflow

Stack-based buffer overflow in eXtremail 2.1.1 and earlier allows remote attackers to execute arbitrary code via a long DNS response. NOTE: this might be related to CVE-2006-6926...

CVE-2007-2187

Stack-based buffer overflow in eXtremail 2.1.1 and earlier allows remote attackers to execute arbitrary code via a long DNS response. NOTE: this might be related to CVE-2006-6926...

CVE-2007-2188

eXtremail 2.1.1 and earlier does not verify the ID field aka transaction id in DNS responses, which makes it easier for remote attackers to conduct DNS spoofing...

CVE-2007-2187

CVE-2007-2187 describes a stack-based buffer overflow in eXtremail 2.1.1 and earlier that allows remote code execution via a long DNS response. The vulnerability affects eXtremail’s DNS handling and is considered high severity (CVSS v2: AV:N/AC:L/Au:N/C:C/I:C/A:C). The provided connected document...

CVE-2007-2188

eXtremail 2.1.1 and earlier does not verify the ID field aka transaction id in DNS responses, which makes it easier for remote attackers to conduct DNS spoofing...

CVE-2007-2187

Stack-based buffer overflow in eXtremail 2.1.1 and earlier allows remote attackers to execute arbitrary code via a long DNS response. NOTE: this might be related to CVE-2006-6926...

CVE-2007-2188

The CVE-2007-2188 entry concerns eXtremail 2.1.1 and earlier, where the application does not verify the DNS response ID (transaction ID). Root cause: lack of verification in DNS responses, enabling remote attackers to perform DNS spoofing. Impact is described as complete confidentiality, integrit...

CVE-2007-2188: Undefined Security Weakness

eXtremail 2.1.1 and earlier does not verify the ID field aka transaction id in DNS responses, which makes it easier for remote attackers to conduct DNS spoofing...

CVE-2007-2187: Undefined Security Weakness

Stack-based buffer overflow in eXtremail 2.1.1 and earlier allows remote attackers to execute arbitrary code via a long DNS response. NOTE: this might be related to CVE-2006-6926...

eXtremail <= 2.1.1 DNS Parsing Bugs Remote Exploit PoC

No description provided by source. / extremail-v9.c Copyright c 2007 by [email protected] eXtremail 2.1.1 remote root POC x86-lnx by mu-b - Tue Feb 6 2007 - Tested on: eXtremail 2.1.0 lnx eXtremail 2.1.1 lnx POC for DNS parsing bugs... ...

[Full-disclosure] eXtremail-v9

The attached POC exploits a trivial stack smash in the DNS parsing code of eXtremail versions = 2.1.1 current. The POC attached is rather trivial in that it simply answers queries with a suitable response to exhibit the overflow. However, the problem is further compounded by the fact that eXtrema...

eXtremail 2.1.1 - DNS Parsing Bugs Remote (PoC)

eXtremail 2.1.1 - DNS Parsing Bugs Remote PoC / extremail-v9.c Copyright c 2007 by eXtremail include include include include include define DNSHDRLEN 12 define DNSTRAILLEN 20 define DNSPORT 53 define DNSMAXMSG 0x200 define HAMMERLEN 284 static char dnshdrbuf = "\x69\x69" / transaction id /...

eXtremail buffer overflow

DNS resolver code buffer overflow...

eXtremail <= 2.1.1 DNS Parsing Bugs Remote Exploit PoC

Exploit for linux platform in category dos / poc ====================================================== eXtremail eXtremail include include include include include define DNSHDRLEN 12 define DNSTRAILLEN 20 define DNSPORT 53 define DNSMAXMSG 0x200 define HAMMERLEN 284 static char dnshdrbuf =...

eXtremail 2.1.1 - DNS Parsing Bugs Remote (PoC)

/ extremail-v9.c Copyright c 2007 by eXtremail include include include include include define DNSHDRLEN 12 define DNSTRAILLEN 20 define DNSPORT 53 define DNSMAXMSG 0x200 define HAMMERLEN 284 static char dnshdrbuf = "\x69\x69" / transaction id / "\x81\x80" / flags / "\x00\x01" / questions /...

CVE-2006-6926

Buffer overflow in eXtremail 2.1 has unknown impact and attack vectors, as demonstrated by VulnDisco Pack. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...