DynFX POPd Denial of Service Vulnerability

From: SNS Research (vuln-devat_private)
Date: Sat May 26 2001 - 09:26:10 PDT

  • Next message: Crispin Cowan: "FormatGuard" 

    Strumpf Noir Society Advisories
! Public release !
<--#


-= DynFX POPd Denial of Service Vulnerability =-

Release date: Saturday, May 26, 2001


Introduction:

DynFX MailServer is an SMTP and POP3 Server package for the WINNT 
and Win2k platforms.

This application is available from vendor DynFX Internet Services'
website: http://www.dynfx.de


Problem(s):

The pop daemon that is part of this package contains a problem in
the logon function. Due to improper handling of overly long (258
bytes or more) usernames this can be abused to remotely crash the
running pop3 service.

The problem appears to be that, altough this is not apparant from
the relevant API documentation, Mutex doesn't properly handle the
unexpectedly long input in below code.

|  strMutex = _T("POP3_") + m_strUser + _T("_Lock");
|  m_pMutex = new CMutex( FALSE, strMutex );

Applying a check on this through limiting the length of m_srtUser
fixes this problem.


(..)


Solution:

Vendor has been notified and has fixed the issue in build 2.10.3604.2
of this product.

This was tested against DynFX MailServer 2.10.3595.1, running on 
MS WINNT 4.0.


Acknowledgement:

Since we feel it should be noted when this is the case as well, we 
would like to thank Daniel Weber of DynFX Internet Services for his
excellent support of this product. The source of the problem and a
fix were established within hours of our initial heads-up.


yadayadayada

Free sk8! (http://www.freesk8.org)

SNS Research is rfpolicy (http://www.wiretrip.net/rfp/policy.html) 
compliant, all information is provided on AS IS basis.

EOF, but Strumpf Noir Society will return!

    This archive was generated by hypermail 2b30 : Tue May 29 2001 - 01:06:25 PDT