Check Point Advisories

Preemptive Protection against Mercury Mail Transport System SMTP AUTH CRAM-MD5 Buffer Overflow Vulnerability

Check Point Reference:	CPAI-2007-103
Date Published:	29 Aug 2007
Severity:	Critical
Last Updated:	Sunday 27 July, 2008
Source:	FrSIRT/ADV-2007-2918
Industry Reference:	CVE-2007-4440
Protection Provided by:
Who is Vulnerable?	Mercury Mail Transport System version 4.51 and prior
Vulnerability Description	A buffer overflow vulnerability has been reported in Mercury Mail Transport System. Mercury Mail Transport System is a free mail server program that supports various email access and exchange protocols, including the Simple Mail Transfer Protocol (SMTP). A remote attacker can exploit this issue to create a denial of service condition or to execute arbitrary code on a vulnerable system.
Update/Patch Avaliable	Apply patches: http://www.pmail.com/patches.htm
Vulnerability Details	The vulnerability is due to a boundary error in the Mercury Mail Transport System that fails to properly handle CRAM-MD5 strings following the SMTP AUTH command. An attacker can exploit this flaw via a long AUTH CRAM-MD5 string. Successful exploitation may allow an attacker to create a denial of service condition or execute arbitrary code on an affected server.