Signature Detail

LDAP: Ipswitch IMail LDAP Daemon Remote Buffer Overflow

This signature detects attempts to exploit a known vulnerability against IPSwitch IMail LDAP daemon. Attacker can craft a malicious LDAP packet that triggers a buffer overflow condition. A successful attacker can cause the application to terminate, or execute arbitrary code on the affected server.

Extended Description

The Ipswitch LDAP daemon has been reported prone to a remote buffer overflow vulnerability. The vulnerability exists due to a lack of sufficient boundary checks performed on user supplied LDAP tags. When attacker-supplied data containing large LDAP tags is processed by the affected service, a stack based buffer overflow condition will be triggered. A remote attacker may exploit this condition to execute arbitrary instructions in the security context of the affected service.

Affected Products

• Ipswitch IMail 8.0.3
• Ipswitch IMail 8.0.5

References

• BugTraq: 9682
• CVE: CVE-2004-0297
• URL: http://www.ipswitch.com/support/imail/releases/imail_professional/im805HF2.html