Full Disclosure mailing list archives
Axigen server version: 2.0.0-beta1 (Linux/i686) - pop3 remote shell
From: fugich <fugich () gmail com>
Date: Fri, 16 Feb 2007 13:51:34 +0000
The code attached exploits a format string vulnerability in the V2 beta version of Axigen. The pop3 service calls syslog in a vulnerable way when the logtype, for the pop3 service, been set to "system" and loglevel is number with 4th bit set. Any unknown command causes the log call with overwriting consequences. This problem is patched in the final release but I am informed that v1 is vulnerable, couldn't get my hands on the binary to test though Thanks to mu-b Have fun fuGich
Attachment:
axiagen.c
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Axigen server version: 2.0.0-beta1 (Linux/i686) - pop3 remote shell fugich (Feb 16)