PT-2005-3301 · Goodtech · Goodtech Smtp Server

Raphaël Rigo · Published 2005-07-27 · Updated 2008-09-05 · CVE-2005-2387

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GoodTech SMTP server version 5.16

Description The issue allows remote attackers to execute arbitrary code via specific commands. This can be achieved by sending a RCPT TO command with a long DNS name, or by sending a large number of RCPT TO commands with a long e-mail name argument in the last command.

Recommendations For GoodTech SMTP server version 5.16, consider restricting access to the RCPT TO command until a patch is available. As a temporary workaround, limit the length of DNS names and e-mail name arguments in RCPT TO commands to prevent buffer overflows.

Exploit

Fix

Related Identifiers

CVE-2005-2387

Affected Products

Goodtech Smtp Server

References · 3

• 🔥 http://seclists.org/lists/bugtraq/2005/Jul/0402.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2387 · Security Note
• http://securityfocus.com/bid/14357 · Note