Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2004.0186 -- NGSSoftware Insight Security Research Advisories
Buffer Overflow Vulnerabilities in SLWebMail
and SLMail Pro Supervisor Report Center
09 March 2004
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: SLWebMail (SLMail Pro)
Supervisor Report Center (SLMail Pro)
Publisher: NGSSoftware
Operating System: Windows 2000
Impact: Execute Arbitrary Code/Commands
Access Required: Remote
Comment: The default installation of SLMail Pro includes Supervisor
Report Center and SLWebMail. NGSSoftware have found buffer
overflow vulnerabilities in these products which could allow an
attacker to execute arbitary commands. Sites running SLMail Pro
are advised to upgrade as soon as possible.
For more information, see the NGSSoftware advisories at:
http://www.nextgenss.com/advisories/slmailsrc.txt
http://www.nextgenss.com/advisories/slmailwm.txt
- --------------------------BEGIN INCLUDED TEXT--------------------
NGSSoftware Insight Security Research Advisory
Name: SLWebMail Multiple Buffer Overflow Vulnerabilities
Systems Affected: SLWebMail (Installed with SLMail Pro version 2.0.9 and
earlier) on Windows.
Severity: High Risk
Vendor URL: http://www.slmail.com/
Author: David Litchfield [ david@ngssoftware.com ]
Date Vendor Notified: 13th January 2004
Date of Public Advisory: 5th March 2004
Advisory number: #NISR05022004b
Advisory URL: http://www.ngssoftware.com/advisories/slmailwm.txt
Description
***********
SLWebMail is a web based e-mail solution designed for the small to medium
enterprise. SLWebMail runs atop Microsoft's Internet Information Server and
is implemented as a set of ISAPI applications. SLWebMail suffers from
multiple buffer overflow vulnerabilities.
Details
*******
SLWebMail is installed with SLMail Pro. Implemented as a set of ISAPI
applications, many suffer from stack based buffer overflow vulnerabilities.
Known to be vulnerable are user.dll, loadpageadmin.dll and loadpageuser.dll.
Even though these ISAPI applications are loaded into dllhost, which runs in
the security context of the IWAM account and not the local system account,
the risk should still be considered as high and customers should install the
patch as soon as is possible.
Fix Information
***************
SLMail have made available a patch to resolve these issues:
http://216.26.170.92/Products/SLMailPro/Utilities.asp . Customers are urged
to update as soon as is possible.
About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware have
offices in the South of London and the East Coast of Scotland. NGSSoftware's
sister company NGSConsulting, offers best of breed security consulting
services, specialising in application, host and network security
assessments.
http://www.ngssoftware.com/
Telephone +44 208 401 0070
Fax +44 208 401 0076
enquiries@ngssoftware.com
NGSSoftware Insight Security Research Advisory
Name: SLMail Pro Supervisor Report Center Buffer Overflow
Systems Affected: SLMail Pro version 2.0.9 and earlier on Windows.
Severity: High Risk
Vendor URL: http://www.slmail.com/
Author: David Litchfield [ david@ngssoftware.com ]
Date Vendor Notified: 7th January 2004
Date of Public Advisory: 5th March 2004
Advisory number: #NISR05022004a
Advisory URL: http://www.ngssoftware.com/advisories/slmailsrc.txt
Description
***********
SLMail Pro is a complete e-mail solution designed for the small to medium
enterprise. A default install of SLMail Pro includes the installation of the
Supervisor Report Center; this has been found vulnerable to a stack based
buffer overflow vulnerability.
Details
*******
The Supervisor Report Center is a self-contained web server. The image file
for the web server is webcontainer.exe and the server HTTP response header
is returned as "OctoWebSvr/COM". The web server listens on TCP port 801 by
default. An attacker can trigger the overflow by making an HTTP request and
providing an overly long HTTP sub-version (HTTP/1.x). This sub-version is
copied to a stack based buffer and is used in the server's response to the
client. On overflow the saved return address stored on the stack is
overwritten allowing the attacker to redirect the process' flow of execution
and gives the ability to run arbitrary code.
Fix Information
***************
SLMail have made available a patch to resolve this issue:
http://216.26.170.92/Products/SLMailPro/Utilities.asp . Customers are urged
to update as soon as is possible.
About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware have
offices in the South of London and the East Coast of Scotland. NGSSoftware's
sister company NGSConsulting, offers best of breed security consulting
services, specialising in application, host and network security
assessments.
http://www.ngssoftware.com/
Telephone +44 208 401 0070
Fax +44 208 401 0076
enquiries@ngssoftware.com
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business
hours which are GMT+10:00 (AEST). On call after hours
for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBQE0NECh9+71yA2DNAQGeogP+LDVuw/lke+apd51pRJtXhx4DYgGAbaIA
ay9G2GQal8purPvVXO/DiyXs286H2Av2ANZXqbOMRN8MAS0KBKe4mALNiH2hbXxP
Ws6IE7KiCQ9kLXqPKWKMogdP0Phs/8z2nFWYv7eEugGHAa5y0fgodRLwfTStfSm6
mwCzqBQJF+M=
=2Jix
-----END PGP SIGNATURE-----