LDAP: Ipswitch IMail LDAP Daemon Remote Buffer Overflow

This signature detects attempts to exploit a known vulnerability against IPSwitch IMail LDAP daemon. Attacker can craft a malicious LDAP packet that triggers a buffer overflow condition. A successful attacker can cause the application to terminate, or execute arbitrary code on the affected server.

Extended Description

The Ipswitch LDAP daemon has been reported prone to a remote buffer overflow vulnerability. The vulnerability exists due to a lack of sufficient boundary checks performed on user supplied LDAP tags. When attacker-supplied data containing large LDAP tags is processed by the affected service, a stack based buffer overflow condition will be triggered. A remote attacker may exploit this condition to execute arbitrary instructions in the security context of the affected service.

Affected Products

Ipswitch imail

References

BugTraq: 9682

CVE: CVE-2004-0297

URL: http://www.ipswitch.com/support/imail/releases/imail_professional/im805HF2.html http://secunia.com/advisories/10880/

Short Name

LDAP:OVERFLOW:IMAIL-ASN-1

Severity

Major

Recommended

False

Recommended Action

Drop

LDAP: Ipswitch IMail LDAP Daemon Remote Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?