-=[+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++]=- ACS Security Assessment Advisory - Format String Overflow ID: ACSSEC-2005-11-25 - 0x5 Class: Format String Overflow Package: FTGate 4.4 [Build 4.4.000 Oct 26 2005] POP3 Service Build: Windows NT/2k/XP/2k3 Notified: Dec 01, 2005 Released: Dec 20, 2005 Remote: Yes Severity: Medium (Pre-Authentication) Credit: Tim Shelton -=[+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++]=- -=[ Background FTGate4 is a powerful Windows(TM) communication suite that combines exceptional mail handling facilities with comprehensive Groupware functionality. Its security and collaboration features were developed in conjunction with leading ISP's and define a new era in mail server performance. -=[ Technical Description FTGate 4.4 [Build 4.4.000 Oct 26 2005] is vulnerable to multiple format string overflows via specially crafted POP3 requests. A remote attacker could issue the vulnerable command followed by a malicious code to execute arbitrary code. -=[ Proof of Concepts USER (%n times 20) PASS (%n times 20) TOP (%n times 20) 1 -=[ Solution No remedy available as of December 2005. -=[ Credits Vulnerability originally reported by Tim Shelton -=[ ChangeLog 2005-11-25 : Original Advisory 2005-12-01 : Notified Vendors 2005-12-20 : No response from vendor, disclosing full information.