Strumpf Noir Society Advisories ! Public release ! <--#
-= DynFX POPd Denial of Service Vulnerability =-
Release date: Saturday, May 26, 2001
DynFX MailServer is an SMTP and POP3 Server package for the WINNT and Win2k platforms.
This application is available from vendor DynFX Internet Services' website: http://www.dynfx.de
The pop daemon that is part of this package contains a problem in the logon function. Due to improper handling of overly long (258 bytes or more) usernames this can be abused to remotely crash the running pop3 service.
The problem appears to be that, altough this is not apparant from the relevant API documentation, Mutex doesn't properly handle the unexpectedly long input in below code.
| strMutex = T("POP3") + m_strUser + _T("_Lock"); | m_pMutex = new CMutex( FALSE, strMutex );
Applying a check on this through limiting the length of m_srtUser fixes this problem.
Vendor has been notified and has fixed the issue in build 2.10.3604.2 of this product.
This was tested against DynFX MailServer 2.10.3595.1, running on MS WINNT 4.0.
Since we feel it should be noted when this is the case as well, we would like to thank Daniel Weber of DynFX Internet Services for his excellent support of this product. The source of the problem and a fix were established within hours of our initial heads-up.
Free sk8! (http://www.freesk8.org)
SNS Research is rfpolicy (http://www.wiretrip.net/rfp/policy.html) compliant, all information is provided on AS IS basis.
EOF, but Strumpf Noir Society will return!