eXtremail 2.1.1 - PLAIN Authentication Remote Stack Overflow

/ extremail-v6.c Copyright c 2006 by eXtremail include include include include include define BUFSIZE 2048 define BBUFSIZE BUFSIZE/34+1 define NOP 0x41 define AUTHCMD "1 AUTHENTICATE PLAIN\n" define DEFPORT 143 define PORTIMAPD DEFPORT define PORTSHELL 4444 static const char movshelllnx =...

Stack overflow

Stack-based buffer overflow in eXtremail 2.1.1 and earlier allows remote attackers to execute arbitrary code via a long DNS response. NOTE: this might be related to CVE-2006-6926...

Spoofing

eXtremail 2.1.1 and earlier does not verify the ID field aka transaction id in DNS responses, which makes it easier for remote attackers to conduct DNS spoofing...

CVE-2007-2187

Stack-based buffer overflow in eXtremail 2.1.1 and earlier allows remote attackers to execute arbitrary code via a long DNS response. NOTE: this might be related to CVE-2006-6926...

CVE-2007-2188

eXtremail 2.1.1 and earlier does not verify the ID field aka transaction id in DNS responses, which makes it easier for remote attackers to conduct DNS spoofing...

CVE-2007-2188

eXtremail 2.1.1 and earlier does not verify the ID field aka transaction id in DNS responses, which makes it easier for remote attackers to conduct DNS spoofing...

CVE-2007-2187

CVE-2007-2187 describes a stack-based buffer overflow in eXtremail 2.1.1 and earlier that allows remote code execution via a long DNS response. The vulnerability affects eXtremail’s DNS handling and is considered high severity (CVSS v2: AV:N/AC:L/Au:N/C:C/I:C/A:C). The provided connected document...

CVE-2007-2187

Stack-based buffer overflow in eXtremail 2.1.1 and earlier allows remote attackers to execute arbitrary code via a long DNS response. NOTE: this might be related to CVE-2006-6926...

CVE-2007-2188

The CVE-2007-2188 entry concerns eXtremail 2.1.1 and earlier, where the application does not verify the DNS response ID (transaction ID). Root cause: lack of verification in DNS responses, enabling remote attackers to perform DNS spoofing. Impact is described as complete confidentiality, integrit...

eXtremail <= 2.1.1 DNS Parsing Bugs Remote Exploit PoC

No description provided by source. / extremail-v9.c Copyright c 2007 by [email protected] eXtremail 2.1.1 remote root POC x86-lnx by mu-b - Tue Feb 6 2007 - Tested on: eXtremail 2.1.0 lnx eXtremail 2.1.1 lnx POC for DNS parsing bugs... ...

eXtremail 2.1.1 - DNS Parsing Bugs Remote (PoC)

eXtremail 2.1.1 - DNS Parsing Bugs Remote PoC / extremail-v9.c Copyright c 2007 by eXtremail include include include include include define DNSHDRLEN 12 define DNSTRAILLEN 20 define DNSPORT 53 define DNSMAXMSG 0x200 define HAMMERLEN 284 static char dnshdrbuf = "\x69\x69" / transaction id /...

[Full-disclosure] eXtremail-v9

The attached POC exploits a trivial stack smash in the DNS parsing code of eXtremail versions = 2.1.1 current. The POC attached is rather trivial in that it simply answers queries with a suitable response to exhibit the overflow. However, the problem is further compounded by the fact that eXtrema...

eXtremail buffer overflow

DNS resolver code buffer overflow...

eXtremail <= 2.1.1 DNS Parsing Bugs Remote Exploit PoC

Exploit for linux platform in category dos / poc ====================================================== eXtremail eXtremail include include include include include define DNSHDRLEN 12 define DNSTRAILLEN 20 define DNSPORT 53 define DNSMAXMSG 0x200 define HAMMERLEN 284 static char dnshdrbuf =...

eXtremail 2.1.1 - DNS Parsing Bugs Remote (PoC)

/ extremail-v9.c Copyright c 2007 by eXtremail include include include include include define DNSHDRLEN 12 define DNSTRAILLEN 20 define DNSPORT 53 define DNSMAXMSG 0x200 define HAMMERLEN 284 static char dnshdrbuf = "\x69\x69" / transaction id / "\x81\x80" / flags / "\x00\x01" / questions /...

CVE-2006-6926

Buffer overflow in eXtremail 2.1 has unknown impact and attack vectors, as demonstrated by VulnDisco Pack. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-6926

Buffer overflow in eXtremail 2.1 has unknown impact and attack vectors, as demonstrated by VulnDisco Pack. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-6926

CVE-2006-6926 describes a buffer overflow in eXtremail 2.1. The primary description explicitly states unknown impact and attack vectors, with details coming from third-party information (VulnDisco Pack). Connected sources corroborate a stack/buffer overflow scenario in eXtremail 2.1.x (and earlie...

Linux eXtremail 1.5.x Remote Format Strings Exploit

No description provided by source. // / Linux eXtremail 1.5.x Remote Format Strings Exploit / / / / / / By B-r00t - 02/07/2003 / / / / Versions: Linux eXtremail-1.5-8 = VULNERABLE / / Linux eXtremail-1.5-5 = VULNERABLE / / Exploit uses format strings bug in fLog of smtpd to bind a / / r00tshell t...

eXtremail 1.x/2.1 - Remote Format String (3)

source: https://www.securityfocus.com/bid/2908/info eXtremail is a freeware SMTP server available for Linux and AIX. eXtremail contains a format-string vulnerability in its logging mechanism. Attackers can send SMTP commands argumented with maliciously constructed arguments that will exploit this...