MDaemon contains a flaw that allows a remote attacker to crash the server. The issue is due to a buffer overflow condition in the SMTP service. By sending a HELO command containing 1024 or more characters to port 25, an attacker will crash the server.
Classification
Location:
Remote / Network Access
Attack Type:
Denial of Service,
Input Manipulation
Impact:
Loss of Integrity,
Loss of Availability
Exploit:
Exploit Public
Solution
Upgrade to version 2.71 Service Pack 2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
dfw.net -
