Vulnerabilities > CVE-2003-0487 - Remote Username Buffer Overrun vulnerability in Kerio Mailserver 5.6.3

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
kerio
nessus
exploit available
NVD
Published: 2003-08-07
Updated: 2017-07-11

Summary

Multiple buffer overflows in Kerio MailServer 5.6.3 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code via (1) a long showuser parameter in the do_subscribe module, (2) a long folder parameter in the add_acl module, (3) a long folder parameter in the list module, and (4) a long user parameter in the do_map module.

Vulnerable Configurations

Part Description Count
Application
Kerio
1

Exploit-Db

  • descriptionKerio Mailserver 5.6.3 list Module Overflow. CVE-2003-0487. Dos exploit for linux platform
    idEDB-ID:22802
    last seen2016-02-02
    modified2003-06-18
    published2003-06-18
    reporterDavid F.Madrid
    sourcehttps://www.exploit-db.com/download/22802/
    titleKerio Mailserver 5.6.3 list Module Overflow
  • descriptionKerio Mailserver 5.6.3 subscribe Module Overflow. CVE-2003-0487. Dos exploit for linux platform
    idEDB-ID:22800
    last seen2016-02-02
    modified2003-06-18
    published2003-06-18
    reporterDavid F.Madrid
    sourcehttps://www.exploit-db.com/download/22800/
    titleKerio Mailserver 5.6.3 subscribe Module Overflow
  • descriptionKerio Mailserver 5.6.3 add_acl Module Overflow. CVE-2003-0487. Dos exploit for linux platform
    idEDB-ID:22801
    last seen2016-02-02
    modified2003-06-18
    published2003-06-18
    reporterDavid F.Madrid
    sourcehttps://www.exploit-db.com/download/22801/
    titleKerio Mailserver 5.6.3 add_acl Module Overflow
  • descriptionKerio Mailserver 5.6.3 do_map Module Overflow. CVE-2003-0487 . Dos exploit for linux platform
    idEDB-ID:22803
    last seen2016-02-02
    modified2003-06-18
    published2003-06-18
    reporterDavid F.Madrid
    sourcehttps://www.exploit-db.com/download/22803/
    titleKerio Mailserver 5.6.3 do_map Module Overflow
  • descriptionKerio MailServer 5.6.3 Remote Buffer Overflow Exploit. CVE-2003-0487. Remote exploit for linux platform
    idEDB-ID:46
    last seen2016-01-31
    modified2003-06-27
    published2003-06-27
    reporterB-r00t
    sourcehttps://www.exploit-db.com/download/46/
    titleKerio MailServer 5.6.3 - Remote Buffer Overflow Exploit

Nessus

NASL familyCGI abuses
NASL idKERIO_WEBMAIL_MULTIPLE_FLAWS.NASL
descriptionThe remote host is running version 5 of the Kerio MailServer. There are multiple flaws in this interface that could allow an attacker with a valid webmail account on this host to obtain a shell on this host or to perform a cross-site-scripting attack against this host with a version prior to 5.6.4. Versions of MailServer prior to 5.6.5 are also prone to a denial of service condition when an incorrect login to the admin console occurs. This could cause the server to crash. Versions of MailServer prior to 5.7.7 are prone to a remotely exploitable buffer overrun condition. This vulnerability exists in the spam filter component. If successfully exploited, this could permit remote attackers to execute arbitrary code in the context of the MailServer software. This could also cause a denial of service in the server. *** This might be a false positive, as Nessus did not have *** the proper credentials to determine if the remote Kerio *** is affected by this flaw.
last seen2020-06-01
modified2020-06-02
plugin id11763
published2003-06-18
reporterThis script is Copyright (C) 2003-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/11763
titleKerio WebMail < 5.7.7 Multiple Vulnerabilities
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
 script_id(11763);
 script_version("1.29");

 script_cve_id("CVE-2002-1434", "CVE-2003-0487", "CVE-2003-0488");
 script_bugtraq_id(
   5507,
   7966, 
   7967, 
   7968, 
   8230, 
   9975
 );

 script_name(english:"Kerio WebMail < 5.7.7 Multiple Vulnerabilities");
 
 script_set_attribute(attribute:"synopsis", value:
"The remote server is vulnerable to several flaws." );
 script_set_attribute(attribute:"description", value:
"The remote host is running version 5 of the Kerio MailServer.

There are multiple flaws in this interface that could allow
an attacker with a valid webmail account on this host 
to obtain a shell on this host or to perform
a cross-site-scripting attack against this host
with a version prior to 5.6.4.

Versions of MailServer prior to 5.6.5 are also prone to a 
denial of service condition when an incorrect login to the
admin console occurs. This could cause the server to crash.

Versions of MailServer prior to 5.7.7 are prone to a remotely 
exploitable buffer overrun condition. This vulnerability exists in the 
spam filter component. If successfully exploited, this could permit 
remote attackers to execute arbitrary code in the context of the 
MailServer software. This could also cause a denial of service in the 
server.

*** This might be a false positive, as Nessus did not have
*** the proper credentials to determine if the remote Kerio
*** is affected by this flaw." );
 script_set_attribute(attribute:"solution", value:
"Upgrade to Kerio MailServer 5.7.7 or newer." );
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
 script_set_cvss_temporal_vector("CVSS2#E:F/RL:ND/RC:ND");
 script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"true");
 script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);

 script_set_attribute(attribute:"plugin_publication_date", value: "2003/06/18");
 script_set_attribute(attribute:"vuln_publication_date", value: "2002/08/19");

 script_cvs_date("Date: 2018/06/13 18:56:27");
 script_set_attribute(attribute:"plugin_type", value:"remote");
 script_set_attribute(attribute:"cpe",value:"cpe:/a:kerio:kerio_mailserver");
 script_end_attributes();
 
 script_summary(english:"Checks for Kerio MailServer");
 script_category(ACT_GATHER_INFO);
 script_copyright(english:"This script is Copyright (C) 2003-2018 Tenable Network Security, Inc.");
 script_family(english:"CGI abuses");
 script_dependencie("find_service1.nasl", "http_version.nasl");
 script_require_ports("Services/www", 80);
 exit(0);
}

include("global_settings.inc");
include("misc_func.inc");
include("http.inc");


port = get_http_port(default:80);

res = get_http_banner(port:port, exit_on_fail: 1);
if (egrep(string:res, pattern:"^Server: Kerio MailServer ([0-4]\.|5\.[0-6]\.|5\.7\.[0-6])") )	
{
 		security_hole(port);
  set_kb_item(name: 'www/'+port+'/XSS', value: TRUE);
}

References