发布日期：2002-08-05
更新日期：2002-08-08

受影响系统：

ArGoSoft Mail Server Pro 1.8.1.6
ArGoSoft Mail Server Pro 1.8.1.5
ArGoSoft Mail Server Pro 1.8.1.4
ArGoSoft Mail Server Pro 1.8.1.3
ArGoSoft Mail Server Pro 1.8.1.2
ArGoSoft Mail Server Pro 1.8.1.1
ArGoSoft Mail Server Pro 1.8.1.7
    - Microsoft Windows NT 4.0
    - Microsoft Windows 98
    - Microsoft Windows 95
    - Microsoft Windows 2000 SP3

描述：

---

BUGTRAQ  ID: 5395
CVE(CAN) ID: CVE-2002-1005

ArGoSoft Mail Server Pro是一款支持POP3/SMTP/FINGER的邮件服务程序，可使用在Microsoft windows操作系统下。

ArGoSoft Mail Server Pro在处理转发和自动应答时存在问题，远程攻击者可以利用这个漏洞进行拒绝服务攻击。

ArGoSoft Mail Server Pro系统中用户可以配置他/她的WEB帐户发送邮件给自己，然后再转发给自己，这样的配置下，管理控制台会出现如下现象：

...
8/4/2002 11:22:42 AM - [    39] Delivering to test
8/4/2002 11:22:42 AM - [    39] Forwarding mail to test
8/4/2002 11:22:43 AM - [    40] Delivering to test
8/4/2002 11:22:43 AM - [    40] Forwarding mail to test
8/4/2002 11:22:44 AM - [    41] Delivering to test
8/4/2002 11:22:44 AM - [    41] Forwarding mail to test
8/4/2002 11:22:44 AM - [    41] Too many Received headers. Mailing loop
suspected
8/4/2002 11:22:45 AM - [    42] Delivering to test
8/4/2002 11:22:45 AM - [    42] Forwarding mail to test
8/4/2002 11:22:45 AM - [    42] Too many Received headers. Mailing loop
suspected

这种情况下，服务程序在尝试20次后就会判断出是信息发生了环路，并进行终止，不会产生拒绝服务，但是，如果用户配置成EMAIL转发给自己，并在WEB设置中配置一个自动应答方式，就会出现如下问题：

/4/2002 11:27:22 AM - [    47] Delivering to 2 recipients
8/4/2002 11:27:22 AM - [    47] Forwarding mail to test
8/4/2002 11:27:22 AM - [    47] Sending auto response...
8/4/2002 11:27:22 AM - [    47] Autoresponse from test has been relayed
to test
8/4/2002 11:27:22 AM - [    48] Delivering to test
8/4/2002 11:27:22 AM - [    47] Forwarding mail to test
8/4/2002 11:27:22 AM - [    48] Forwarding mail to test
8/4/2002 11:27:22 AM - [    47] Sending auto response...
8/4/2002 11:27:22 AM - [    47] Autoresponse not sent, because it has
been recently sent to test
8/4/2002 11:27:22 AM - [    48] Sending auto response...
8/4/2002 11:27:22 AM - [    48] Message seems to be autoresponse itself.
Will ignore to avoid loops
...
8/4/2002 11:28:37 AM - [   133] Message seems to be autoresponse itself.
Will ignore to avoid loops
8/4/2002 11:28:38 AM - [   134] Delivering to test
8/4/2002 11:28:38 AM - [   134] Forwarding mail to test
8/4/2002 11:28:38 AM - [   134] Sending auto response...
8/4/2002 11:28:38 AM - [   134] Autoresponse from test has been relayed
to test
8/4/2002 11:28:38 AM - [   135] Delivering to test
8/4/2002 11:28:38 AM - [   135] Forwarding mail to test
8/4/2002 11:28:38 AM - [   135] Sending auto response...
<turned off server to avoid problems>
8/4/2002 11:28:39 AM - Web server stopped
8/4/2002 11:28:39 AM - Finger server stopped
8/4/2002 11:28:39 AM - POP3 server stopped
8/4/2002 11:28:39 AM - SMTP server stopped

在上面这种情况下，服务器不能转发信息是否出现环路，导致无限循环，多种这样的邮件发送给服务器处理，可导致服务崩溃，产生拒绝服务。


<*来源：Stan Bubrouski （stan@ccs.neu.edu）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=102857592309228&w=2
*>

建议：

---

临时解决方法：

如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁：

* 禁止不可信用户访问ArGoSoft Mail Server Pro。

厂商补丁：

ArGoSoft
--------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.argosoft.com/applications/mailserver/

浏览次数：2886
严重程度：0（网友投票）