[NEWS] Novell NetMail NMAP Agent "USER" Buffer Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Novell NetMail NMAP Agent "USER" Buffer Overflow
------------------------------------------------------------------------

SUMMARY

" <http://www.novell.com/products/netmail/> Novell NetMail is an e-mail
and calendaring system that is based on Internet-standard messaging and
security protocols."

Lack of proper length checking allow attackers to execute arbitrary code
by overflowing an internal buffer used by the Novell NetMail.

DETAILS

Vulnerable Systems:
* Novell NetMail version 3.52C

Immune Systems:
* Novell NetMail version 3.52D

The vulnerability is caused due to a boundary error in the NMAP (Network
Messaging Application Protocol) Agent when handling an overly long user
name in the "USER" command. This can be exploited to cause a stack-based
buffer overflow and allows arbitrary code execution.

Successful exploitation requires valid logon to the NMAP Agent (e.g. if
the default NMAP authentication credential has not been changed).

Vendor Status:
The vendor has issued an update:
NetWare:
<http://support.novell.com/servlet/filedownload/pub/netmail352d_nw.zip>
http://support.novell.com/servlet/filedownload/pub/netmail352d_nw.zip
Windows:
<http://support.novell.com/servlet/filedownload/pub/netmail352d_win.zip>
http://support.novell.com/servlet/filedownload/pub/netmail352d_win.zip
Linux:
<http://support.novell.com/servle...load/sec/pub/netmail352d_lin.tgz>
http://support.novell.com/servle...load/sec/pub/netmail352d_lin.tgz

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2469>
CAN-2005-2469

Disclosure Timeline:
18/07/2005 - Initial vendor notification
18/07/2005 - Initial vendor reply
10/10/2005 - Vendor released fixed version
12/10/2005 - Public disclosure

ADDITIONAL INFORMATION

The information has been provided by <mailto:vuln@secunia.com> Secunia
Research.
The original article can be found at:
<http://secunia.com/advisories/15925/>
http://secunia.com/advisories/15925/

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.