Description
Stack-based buffer overflow in the MercuryS SMTP server in Mercury Mail Transport System, possibly 4.51 and earlier, allows remote attackers to execute arbitrary code via a long AUTH CRAM-MD5 string. NOTE: this might overlap CVE-2006-5961.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Mercury Mail SMTP AUTH CRAM-MD5 Buffer Overflow
exploit/windows/smtp/mercury_cram_md5
Exploit-DB 3
- Mercury/32 Mail SMTPD - AUTH CRAM-MD5 Buffer Overflow (Metasploit) EDB-16821 · remote · Jun 22, 2010 · verified
- Mercury/32 Mail SMTPD 4.51 - SMTPD CRAM-MD5 Remote Overflow EDB-4301 · remote · Aug 22, 2007 · verified
- Mercury/32 Mail SMTPD - Remote Stack Overrun (PoC) EDB-4294 · dos · Aug 18, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 26519 third-party-advisory
- 20070818 Mercury SMTPD Remote Preauth Stack Based Overrun mailing-list
- ADV-2007-2918 vdb-entry
- 4294 exploit
- http://www.pmail.com/m32_451.htm
- 25357 vdb-entry
- mercury-smtp-bo(36117) vdb-entry
- 1018587 vdb-entry
- mercury-authcrammd5-bo(36299) vdb-entry