Subject: help

From: "tuxiaokun" <[email-masked]>
Date: Sat, 29 Apr 2000 17:59:31 +0800

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

-----'‚ º" ºœ-----
…¢ºœ»À: hjj [mailto:[email-masked]]
…¢ÀÕ ±º”: 2000ŸÍ4'¬29»' 11:59
 'ºœ»À: [email-masked]
÷—Ã’: help

Dear Ted:
Now I need your helps very much.
Yesterday,I used a security tool( ISS ) to scan FWTK,and the result tell me there is a
high vulnerability about smap.It said:
[ 
SMTP HELO buffer overflow can crash or obtain access
	]
I checked the source smap.c about HELO parts.I think the programe just receive a
command from stdin like :hello XXXX ,and then echo :helo XXXX .There seems nothing about 
buffer, so why this leak exist? The scan report that commands VRFY and EXPN of some version mail may have the same question.
So,I want to know what this really mean and how to recure it?

Eager for your reply and thanks advanced.

hjj.

---

From: Joseph S D Yao <[email-masked]>
Date: Mon, 1 May 2000 14:46:58 -0400

On Sat, Apr 29, 2000 at 05:59:31PM +0800, tuxiaokun wrote:
...
> So,I want to know what this really mean and how to recure it?

Security tools often report "false positives": you should check any
such reports out, but they may turn out to be false.

In this case, however, one of the fixes in the so-called "yao patch"
was that I did take out several possible buffer overflows.  But I did
not change any responses.  So, any checks that ISS did for buffer
overflows after installing the patch would probably still say "true",
but I am pretty sure that there would in fact be no buffer overflows
left.

It is also possible that ISS thinks it was talking to a vulnerable
version of 'sendmail'.  ;-)  The best way for you to know for sure what
it meant is to ask the program's authors, if you bought the current
version.  If you are using the unpaid version, then that is quite a few
years old, IIRC, and is probably not to be trusted at all these days.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Rick Murphy <[email-masked]>
Date: Mon, 01 May 2000 17:41:08 -0400

At 05:59 PM 4/29/00 +0800, tuxiaokun wrote:
>Yesterday,I used a security tool( ISS ) to scan FWTK,and the result tell 
>me there is a high vulnerability about smap.It said:
>[

smap reads the HELO command using a routine that knows how large the buffer 
is. Copies of the HELO string are allocated using malloc(). Chances are, 
your message warning about 'buffer overflow can crash' is issued for all 
SMTP servers.

>The scan report that commands VRFY and EXPN of some version mail may have 
>the same question.

Again, I don't think there's a bug here. Old versions of smap didn't verify 
the length of the recipient part when logging VRFY attempts; the current 
versions of smap aren't vulnerable here.
         -Rick

---

From: -=ArkanoiD=- <[email-masked]>
Date: Tue, 2 May 2000 22:28:41 +0400 (MSD)

nuqneH,

Throw away ISS and never, NEVER trust security scanners if you don't know
exactly what they do.

Somebody (maybe you, tuxiaokun) WROTE:
[Charset ISO-8859-1 unsupported, filtering to ASCII...]

-- 
                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!