INFIGO IS Security Advisory #INFIGO-2008-03-07

Title:	Surgemail 38k4 IMAP server remote stack overflow
Advisory ID:	INFIGO-2008-03-07
Date:	2008-03-21
Advisory URL:	http://www.infigo.hr/en/in_focus/advisories/INFIGO-2008-03-07
Impact:	Remote code execution
Risk Level:	High
Vulnerability Type:	Remote

==[ Overview

SurgeMail Mail Server Software Suite - combines advanced features, high
performance and ease of use. Works on Windows, UNIX (Linux, Solaris etc.), Mac OSX,
FreeBSD and others. Surgemail integrated email server is an Antispam Server,
Antivirus Server, Webmail Server, Groupware Server, Blog Server and much more.

==[ Vulnerability

A remote vanilla stack overflow vulnerability exists in the Surgemail IMAP server.
The vulnerability is caused due to a boundary error in the IMAP server, when
processing overly long arguments of the 'LSUB' command.
The vulnerability results in a simple stack overflow condition that can be
trivially exploited.

Example:
a002 LSUB "//AA:" * 12000 + " " + "//AA:" * 21000 + "\r\n"

==[ Affected Version

The vulnerability has been identified in the latest available 38k4-4.
It was tested on Windows XP SP2.

==[ Fix

The vendor released a new version that fixes the vulnerability available at
http://www.netwinsite.com/surgemail/.

==[ PoC Exploit

Surgemail remote stack overflow PoC

==[ Vendor status

01.09.2008 - Initial contact
01.10.2008 - Initial vendor response
03.19.2008 - Vendor status update - Patch available
03.21.2008 - Coordinated public disclosure

==[ Credits

Vulnerability discovered by Leon Juranic <leon.juranic@infigo.hr>

==[ Contact

INFIGO IS

Web: http://www.infigo.hr
E-mail: infocus@infigo.hr