Signature Detail
Short Name |
POP3:OVERFLOW:BSD-OFLOW-1 |
|---|---|
Severity |
Critical |
Recommended |
No |
Recommended Action |
Drop |
Category |
POP3 |
Keywords |
POP3 Buffer Overflow - BSD x86 (1) |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
POP3 Buffer Overflow - BSD x86 (1)
This signature detects attempts to exploit the user name routine vulnerability in POP3 running on BSD. Attackers can craft a malicious username causing a buffer overflow, which could allow the execution of arbitrary commands with increasing privilege levels.
Extended Description
A number of buffer-overflow issues reside in versions prior to 2.5 of Qualcomm's 'qpopper' program. Exploiting this issue allows a remote attacker to execute arbitrary commands on hosts that are running a vulnerable version. To determine if you are vulnerable, telnet to port 110 on the possibly vulnerable host. A banner appears, informing you of the version of the pop server. For example: % telnet yourmailhost.your.domain.com 110 Trying 123.123.123.123 Connected to mailhost +OK QPOP (version 2.4) at yourmailhost.your.domain.com starting If any version prior to 2.5 is reported, including 2.5 beta, you should upgrade immediately to the latest version.
Affected Products
- Qualcomm qpopper 2.4.0
References