PROBLEM:

UssrLabs found multiple places in MDaemon v2.8.5.0 where they do not use proper bounds checking.

The following all result in a Denial of Service against the service in question.

Afected services:

WorldClient: Port 2000

WebConfig : Port 2002

This two remotes services are afected to overflow of you send a large url name.

Vendor Status:

Contacted.

Vendor Url: http://www.mdaemon.com

Credit: USSRLABS

SOLUTION:

Patch to fix in: http://mdaemon.deerfield.com/helpdesk/hotfix.htm

u n d e r g r o u n d s e c u r i t y s y s t e m s r e s e a r c h