Check Point Advisories

Youngzsoft CMailServer CMailCOM ActiveX Control Buffer Overflow

Vulnerability
Protection

Check Point Reference:	CPAI-2008-309
Date Published:	30 Sep 2009
Severity:	Medium
Last Updated:	Wednesday 30 September, 2009
Source:
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	Youngzsoft CMailServer is a mail server and web mail server software, aimed for small to medium size companies. CMailServer enables sending and receiving emails over the Internet or within the LAN and has support for client email applications such as Outlook, Eudora etc. Also, it supports Hotmail-like web mail service. The web mail function is based on ASP scripts. It also supports multiple domain names and SMTP authentication. There exists a stack buffer overflow in Youngzsoft CMailServer product. The vulnerability is due to improper handling of user requests. A remote authenticated attacker can exploit this vulnerability by sending crafted requests to the target host. Successful exploitation would allow the attacker to execute arbitrary code on the vulnerable system with NETWORK SERVICE privileges. In a sophisticated attack case where code injection is successful, the behaviour of the target is entirely dependent on the intended function of the injected code. The code in such a case would execute within the security context of the Network Service. In an attack case where code injection is not successful, the IIS service might terminate and all established connections will also be terminated.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Youngzsoft CMailServer CMailCOM ActiveX Control Buffer Overflow protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Application Servers Protection Violation.
Attack Information: Youngzsoft CMailServer CMailCOM ActiveX Control buffer overflow