Signature Detail

LDAP: Imail Buffer Overflow

This signature detects attempts to exploit a known vulnerability in the Imail LDAP service. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the server.

Extended Description

The Ipswitch LDAP daemon has been reported prone to a remote buffer overflow vulnerability. The vulnerability exists due to a lack of sufficient boundary checks performed on user supplied LDAP tags. When attacker-supplied data containing large LDAP tags is processed by the affected service, a stack based buffer overflow condition will be triggered. A remote attacker may exploit this condition to execute arbitrary instructions in the security context of the affected service.

Affected Products

• Ipswitch IMail 8.0.3
• Ipswitch IMail 8.0.5

References

• BugTraq: 9682
• CVE: CVE-2004-0297