Vulnerability

    XMail

Affected

    XMail version prior to 0.59

Description

    Aviram Jenik found following.   XMail is an Internet and  Intranet
    mail server featuring an SMTP server, POP3 server, finger  server,
    multiple  domains,  and  more.  XMail's  parsing function does not
    perform  proper  bound  checking  when  parsing  the APOP and USER
    commands, and this allows  a remote attacker to  execute arbitrary
    code by issuing a long APOP or USER commands.

    By issuing standard POP3 commands  to the XMail POP3 server  it is
    possible to cause it to overflow an internal buffer, thus  causing
    it to execute arbitrary code.   For example, after you connect  to
    an XMail POP server, sending any of the commands:

        USER [a buffer of over 256 characters]
        APOP [a buffer of over 256 characters] [a buffer of over 256 characters]

    will  crash  the  server.   If  the  buffer  is  properly crafted,
    arbitrary code can be executed.

    The security hole was discovered by Beyond Security's SecuriTeam.

Solution

    XMail version  0.59 is  OK.   A patched  version can be downloaded
    from:

        http://www.maticad.it/davide/xmail.asp