Gary Oleary-Steele
12/10/05, 21:25
=20 SEC-1 LTD.
=20 www.sec-1.com
=20 Security Advisory
Advisory Name: GFI MailSecurity 8.1 Web Module Buffer Overflow
=20Release Date: 12/October/2005
=20 Application: GFI MailSecurity For SMTP version 8.1
=20 Platform: Verified on Windows 2000 Server
=20 Severity: Remote Code Execution=20
=20 Author: Gary O'leary-Steele=20
Vendor Status: Patch Released
CVE Candidate: Pending
=20 Reference: http://www.sec-1.com
Overview:=20
Taken from gfi.com:
GFI MailSecurity for SMTP is a Content filtering, anti-virus and=20
Email Intrusion prevention product from GFI.
GFI MailSecurity is available as an SMTP gateway version and for=20
VS API. The gateway version should be deployed at the perimeter=20
of the network as a mail relay server and scans inbound and=20
outbound mail. The VS API version integrates seamlessly with=20
Exchange Server 2000/2003 and scans the Exchange information stores.
Both versions can be deployed simultaneously to achieve optimum=20
protection.
Vulnerability Details:=20
Sec-1 has identified an exploitable Buffer Overflow within the HTTP
management interface. By sending large strings within several areas
of the HTTP request (such as a large 'Host' or 'Accept' header)
critical portions of memory are overwritten. Verification of this
vulnerability can be achieved through the use of a HTTP fuzzer, such=20
as @stake webproxy. Successful exploitation could allow an attacker
to gain administrative control of the targeted host.
Vendor Response:
The vendor has released information and a patch
KB: http://kbase.gfi.com/showarticle.asp?id=3DKBID002451
Patch: ftp://ftp.gfi.com/patches/MSEC8_PATCH_20050919_01.zip
Common Vulnerabilities and Exposures (CVE) Information:
The Common Vulnerabilities and Exposures (CVE) project has assigned=20
the following names to these issues. These are candidates for=20
inclusion in the CVE list (http://cve.mitre.org), which standardizes=20
names for security problems.
Pending
Copyright 2005 Sec-1 LTD. All rights reserved.
************************************************** ************
NEW: Sec-1 Hacking Training - Learn to breach network security=20
to further your knowledge and protect your network=20
http://www.sec-1.com/applied_hacking_course.html
************************************************** ************
=20 www.sec-1.com
=20 Security Advisory
Advisory Name: GFI MailSecurity 8.1 Web Module Buffer Overflow
=20Release Date: 12/October/2005
=20 Application: GFI MailSecurity For SMTP version 8.1
=20 Platform: Verified on Windows 2000 Server
=20 Severity: Remote Code Execution=20
=20 Author: Gary O'leary-Steele=20
Vendor Status: Patch Released
CVE Candidate: Pending
=20 Reference: http://www.sec-1.com
Overview:=20
Taken from gfi.com:
GFI MailSecurity for SMTP is a Content filtering, anti-virus and=20
Email Intrusion prevention product from GFI.
GFI MailSecurity is available as an SMTP gateway version and for=20
VS API. The gateway version should be deployed at the perimeter=20
of the network as a mail relay server and scans inbound and=20
outbound mail. The VS API version integrates seamlessly with=20
Exchange Server 2000/2003 and scans the Exchange information stores.
Both versions can be deployed simultaneously to achieve optimum=20
protection.
Vulnerability Details:=20
Sec-1 has identified an exploitable Buffer Overflow within the HTTP
management interface. By sending large strings within several areas
of the HTTP request (such as a large 'Host' or 'Accept' header)
critical portions of memory are overwritten. Verification of this
vulnerability can be achieved through the use of a HTTP fuzzer, such=20
as @stake webproxy. Successful exploitation could allow an attacker
to gain administrative control of the targeted host.
Vendor Response:
The vendor has released information and a patch
KB: http://kbase.gfi.com/showarticle.asp?id=3DKBID002451
Patch: ftp://ftp.gfi.com/patches/MSEC8_PATCH_20050919_01.zip
Common Vulnerabilities and Exposures (CVE) Information:
The Common Vulnerabilities and Exposures (CVE) project has assigned=20
the following names to these issues. These are candidates for=20
inclusion in the CVE list (http://cve.mitre.org), which standardizes=20
names for security problems.
Pending
Copyright 2005 Sec-1 LTD. All rights reserved.
************************************************** ************
NEW: Sec-1 Hacking Training - Learn to breach network security=20
to further your knowledge and protect your network=20
http://www.sec-1.com/applied_hacking_course.html
************************************************** ************