Product: Smart Server 3 by NetCPlus

Version: 3.75.x (others?)



Description:



There are remote DoS vulnerabilities in both the SMTP and POP components of

the SmartServer3 email server.  By passing large arguments to commands in

both components, the services can be caused to fail.



POP3:



A large argument (a couple thousand characters) with either the USER or PASS

commands will cause the server to react to every individual character

entered afterwards on the current and subsequent connections with an error

message stating that the argument is too long.  For instance, if another

user connects after the attack takes place, the mail server would respond to

'USER bob' with seven seperate error messages.  The service must be stopped

and restarted in order to function properly.  The SMTP and POP services can

be stopped and started from the SS3 console (the 'File' menu), it is not

necessary to close the program..



SMTP:



A large argument ( a couple thousand characters) given to any command (other

than DATA) after the HELO command will cause the server to stop responding

to commands.  So, if an attacker connects and enters:



HELO whatever.com

MAIL FROM: 



The service will still be able to accept subsequent connections but will be

unable to respond to anything given on any connection until the service is

stopped and restarted.



Solution:



There are at the time of this writing no solutions for the above issues.

Anyone affected should contact the vendor.  These vulnerabilities are

generic and have affected other mail servers in the past.  Unfortunately,

the symptoms of this attack would be difficult to recognize without prior

knowledge.  It would simply appear that the services freeze from time to

time and need to be restarted.



The vendor was contacted in regards to a previous security issue with this

product.  Unfortunately, the vendor acted in an extremely unprofessional

manner.  In addition to denying the problem, they responded with insults

and implied threats against me.  At this point, it is up to the customers of

this  vendor to ask for what they deserve: a reasonable measure of

reliability.



-Steven Alexander

steve@cell2000.net