Remote DoS in SmartServer 3

[Steven Alexander <steve () cell2000 net>]

Product: Smart Server 3 by NetCPlus
Version: 3.75.x (others?)

Description:

There are remote DoS vulnerabilities in both the SMTP and POP components of
the SmartServer3 email server.  By passing large arguments to commands in
both components, the services can be caused to fail.

POP3:

A large argument (a couple thousand characters) with either the USER or PASS
commands will cause the server to react to every individual character
entered afterwards on the current and subsequent connections with an error
message stating that the argument is too long.  For instance, if another
user connects after the attack takes place, the mail server would respond to
'USER bob' with seven seperate error messages.  The service must be stopped
and restarted in order to function properly.  The SMTP and POP services can
be stopped and started from the SS3 console (the 'File' menu), it is not
necessary to close the program..

SMTP:

A large argument ( a couple thousand characters) given to any command (other
than DATA) after the HELO command will cause the server to stop responding
to commands.  So, if an attacker connects and enters:

HELO whatever.com
MAIL FROM: <A Bunch of Garbage Here>

The service will still be able to accept subsequent connections but will be
unable to respond to anything given on any connection until the service is
stopped and restarted.

Solution:

There are at the time of this writing no solutions for the above issues.
Anyone affected should contact the vendor.  These vulnerabilities are
generic and have affected other mail servers in the past.  Unfortunately,
the symptoms of this attack would be difficult to recognize without prior
knowledge.  It would simply appear that the services freeze from time to
time and need to be restarted.

The vendor was contacted in regards to a previous security issue with this
product.  Unfortunately, the vendor acted in an extremely unprofessional
manner.  In addition to denying the problem, they responded with insults
and implied threats against me.  At this point, it is up to the customers of
this  vendor to ask for what they deserve: a reasonable measure of
reliability.

-Steven Alexander
steve () cell2000 net