|
Netwin DMailWeb & CWMail Multiple DoS Vulnerabilities
From the original (attached in the 'Credit') section post on this vulnerability from Chris Wolfe <9cw4@qlink.queensu.ca> : Sending long values as the username (>= 240 chars, 239 works normally) will cause the script to freeze (just over a minute on the machines tested). The pophost field has a similar problem, though it requires more characters to trigger (tested 512). An extremely long pophost (tested 1024) causes the script to freeze and then crash. I am not equipped to test for buffer overflow conditions, but suspect one is the cause of the crash. (2.6j removed the delay but still crashes). |
|
|
Privacy Statement |
