Title: eXtremail Remote Format String Vulnerability
Severity: CRITICAL
Description:
eXtremail is a freeware SMTP server available for Linux and AIX.
eXtremail contains a format-string vulnerability in its logging mechanism. All SMTP commands recieved by the server are logged. During this process, user-supplied command arguments are passed to a *printf function as the format-string argument. If there are any format specifiers in this data, they will be interpreted and acted upon by the 'printf' implementation.
Since certain format specifiers allow writing to memory, an attacker may be able to create a format-string value that will cause almost arbitrary values to be written to attacker-supplied locations in memory.
The attacker may be able to use these format specifiers in a maliciously constructed command argument to cause critical areas of memory to be corrupted. The attacker may be able to execute arbitrary code on the host if a return address or function pointer is overwritten.
eXtremail runs with root privileges. By exploiting this vulnerability, remote attackers can gain superuser access on the underlying host and can crash eXtremail. If the system is not restarted automatically, a denial of SMTP service will result.
UPDATE (April 26, 2004): Reportedly, this vulnerability has been reintroduced into the new version (1.5.9) of eXtremail.
UPDATE (October 26, 2007): Reports indicate that the 'USER' command of eXtremail 2.1.1 and prior is still vulnerable. Symantec has not confirmed this.
Affected Products:
- eXtremail eXtremail 1.0.0
- eXtremail eXtremail 1.0.1
- eXtremail eXtremail 1.0.2
- eXtremail eXtremail 1.0.3
- eXtremail eXtremail 1.1.0
- eXtremail eXtremail 1.1.1
- eXtremail eXtremail 1.1.2
- eXtremail eXtremail 1.1.3
- eXtremail eXtremail 1.1.4
- eXtremail eXtremail 1.1.5
- eXtremail eXtremail 1.1.6
- eXtremail eXtremail 1.1.7
- eXtremail eXtremail 1.1.8
- eXtremail eXtremail 1.1.9
- eXtremail eXtremail 1.5.0
- eXtremail eXtremail 1.5.0-5
- eXtremail eXtremail 1.5.0-8
- eXtremail eXtremail 1.5.9
- eXtremail eXtremail 2.1
- eXtremail eXtremail 2.1.1
References:
- eXtremail: eXtremail Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
