Description
A stack-based buffer overflow vulnerability exists in ActFax Server version 5.01. The server's RAW protocol interface fails to safely process user-supplied data in @F506 fax header fields due to insecure usage of strcpy. Remote attackers can exploit this vulnerability by sending specially crafted @F506 fields, potentially leading to arbitrary code execution. Successful exploitation requires network access to TCP port 4559 and does not require authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ActFax Communication | ActFax Server | 5.01 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
ActFax 5.01 RAW Server Buffer Overflow
exploit/windows/misc/actfax_raw_server_bof
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://www.actfax.com/ product
- https://web.archive.org/web/20130212065755/http://www.pwnag3.com/2013/02/actfax-raw-server-exploit.html technical-description exploit
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/misc/actfax_raw_server_bof.rb exploit
- https://www.exploit-db.com/exploits/24467 exploit
- https://www.vulncheck.com/advisories/actfax-raw-server-buffer-overflow third-party-advisory