SLMail Pro Supervisor Report Center Buffer Overflow

NGSSoftware Insight Security Research Advisory

Name: SLMail Pro Supervisor Report Center Buffer Overflow
Systems Affected: SLMail Pro version 2.0.9 and earlier on Windows.
Severity: High Risk
Vendor URL: http://www.slmail.com/
Author: David Litchfield [ david@ngssoftware.com ]
Date Vendor Notified:    7th January 2004
Date of Public Advisory: 5th March 2004
Advisory number: #NISR05022004a
Advisory URL: http://www.ngssoftware.com/advisories/slmailsrc.txt

Description
***********
SLMail Pro is a complete e-mail solution designed for the small to medium enterprise. A default install of
SLMail Pro includes the installation of the Supervisor Report Center; this has been found vulnerable to a
stack based buffer overflow vulnerability.

Details
*******
The Supervisor Report Center is a self-contained web server. The image file for the web server is
webcontainer.exe and the server HTTP response header is returned as “OctoWebSvr/COM”. The web server
listens on TCP port 801 by default. An attacker can trigger the overflow by making an HTTP request and
providing an overly long HTTP sub-version (HTTP/1.x). This sub-version is copied to a stack based buffer
and is used in the server’s response to the client. On overflow the saved return address stored on the
stack is overwritten allowing the attacker to redirect the process’ flow of execution and gives the
ability to run arbitrary code.

Fix Information
***************
SLMail have made available a patch to resolve this issue:
http://216.26.170.92/Products/SLMailPro/Utilities.asp .
Customers are urged to update as soon as is possible.

About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application security assessment scanners.
Based in the United Kingdom, NGSSoftware have offices in the South of London and the East Coast of
Scotland. NGSSoftware’s sister company NGSConsulting, offers best of breed security consulting services,
specialising in application, host and network security assessments.

http://www.ngssoftware.com/

Telephone +44 208 401 0070
Fax +44 208 401 0076

enquiries@ngssoftware.com