SurgeMail CGI可执行程序远程溢出漏洞

BUGTRAQ ID: 27992 SurgeMail是下一代的邮件服务器，可运行在Windows NT/2K或UNIX平台上，支持所有的标准IMAP、POP3、SMTP、SSL和ESMTP协议。 SurgeMail中用于处理CGI可执行程序的函数中存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制服务器。...

SurgeMail Page命令远程格式串处理漏洞

BUGTRAQ ID: 27990 SurgeMail是下一代的邮件服务器，可运行在Windows NT/2K或UNIX平台上，支持所有的标准IMAP、POP3、SMTP、SSL和ESMTP协议。 SurgeMail中用于处理webmail接口（webmail.exe）的CGI存在安全漏洞，远程攻击者可能利用此漏洞控制服务器。 CGI中用于在请求错误页面时构建错误消息的函数未经验证格式参数便直接将其传送给了lvprintf： "TPL: Failed to Locate Template c:\surgemail\webmail\panel%s%s%s%s%s%s.tpl2=No suc...

Surgemail and WebMail 3.0 - Page Remote Format String

Surgemail and WebMail 3.0 - Page Remote Format String source: https://www.securityfocus.com/bid/27990/info SurgeMail and WebMail are prone to a remote format-string vulnerability because the applications fail to properly sanitize user-supplied input before including it in the format-specifier...

Surgemail 3.0 - Real CGI executables Remote Buffer Overflow

Surgemail 3.0 - Real CGI executables Remote Buffer Overflow source: https://www.securityfocus.com/bid/27992/info SurgeMail is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input. Successfully exploiting this issue allows remote attackers t...

Surgemail and WebMail 3.0 - 'Page' Remote Format String

source: https://www.securityfocus.com/bid/27990/info SurgeMail and WebMail are prone to a remote format-string vulnerability because the applications fail to properly sanitize user-supplied input before including it in the format-specifier argument of a formatted-printing function. A remote...

Surgemail 3.0 - Real CGI executables Remote Buffer Overflow

source: https://www.securityfocus.com/bid/27992/info SurgeMail is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input. Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the...

CVE-2007-6457

Stack-based buffer overflow in the webmail feature in SurgeMail 38k4 allows remote attackers to cause a denial of service crash via a long Host header...

Stack overflow

Stack-based buffer overflow in the webmail feature in SurgeMail 38k4 allows remote attackers to cause a denial of service crash via a long Host header...

CVE-2007-6457

Stack-based buffer overflow in the webmail feature in SurgeMail 38k4 allows remote attackers to cause a denial of service crash via a long Host header...

CVE-2007-6457

CVE-2007-6457: SurgeMail 38k4 webmail has a stack-based buffer overflow in its webmail feature; a long Host header can trigger remote DoS (crash). Impact is partial availability. Public fix/remediation details are not provided in the provided documents; monitor for updates.

SurgeMail v.38k4 webmail Host header Denial of Service Exploit

No description provided by source. ?php / SurgeMail v.38k4 webmail Host header denial of service exploit tested against the windows version rgod / dl"phpcurl.so"; $url = "http://192.168.0.1"; $puf=strrepeat0xff,0xfff; $header ="POST / HTTP/1.0\r\n"; $header.="Host: $puf\r\n"; $header.="Connection...

SurgeMail v.38k4 webmail Host header crash

?php / SurgeMail v.38k4 webmail Host header denial of service exploit tested against the windows version rgod / dl"phpcurl.so"; $url = "http://192.168.0.1"; $puf=strrepeat0xff,0xfff; $header ="POST / HTTP/1.0rn"; $header.="Host: $pufrn"; $header.="Connection: Closernrn"; $ch = curlinit;...

surgemail-crash.txt

original url: http://retrogod.altervista.org/rgodsurgemailcrash.html...

SurgeMail v.38k4 webmail Host header Denial of Service Exploit

Exploit for unknown platform in category dos / poc ============================================================== SurgeMail v.38k4 webmail Host header Denial of Service Exploit ============================================================== 0day.today 2018-04-11...

Surgemail 38k4 - webmail Host header Denial of Service

Surgemail 38k4 - webmail Host header Denial of Service milw0rm.com 2007-12-18...

SurgeMail畸形HOST头字段数据拒绝服务漏洞

SurgeMail是一款WEB MAIL应用程序。 SurgeMail不正确处理HTTP POST请求，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 由于不正确处理HTTP POST提交的HOST字段数据，可导致应用程序崩溃，造成拒绝服务攻击。 NetWin SurgeMail 38k4 目前没有解决方案提供： http://www.netwinsite.com/surgemail/ ?php / SurgeMail v.38k4 webmail Host header denial of service exploit tested against the windows...

Surgemail 38k4 - webmail Host header Denial of Service

milw0rm.com 2007-12-18...

SurgeMail IMAP Server SEARCH Command Remote Buffer Overflow

According to its banner, the remote host is running a version of the SurgeMail Mail Server older than 3.8k2 / 3.8m. Such versions are reportedly affected by a buffer overflow flaw in its IMAP service that can be triggered using a specially crafted 'SEARCH' command. An authenticated attacker can...

SurgeMail SEARCH命令远程栈缓冲区溢出漏洞

BUGTRAQ ID: 25318 SurgeMail是下一代的邮件服务器，可运行在Windows NT/2K或UNIX平台上，支持所有的标准IMAP、POP3、SMTP、SSL和ESMTP协议。 SurgeMail在处理带有超长畸形参数的SEARCH命令时存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制服务器。 如果对SurgeMail提交了有超长参数的IMAP SEARCH命令的话，就可能触发栈溢出，导致执行任意指令。 NetWin SurgeMail 38k 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

Stack overflow

Stack-based buffer overflow in the IMAP service in SurgeMail 38k allows remote authenticated users to execute arbitrary code via a long argument to the SEARCH command. NOTE: this might overlap CVE-2007-4372...