CVE-2004-1945

Vulnerability

Kinesphere eXchange POP3 prior to build 5.0.1629 contains a buffer overflow vulnerability in its SMTP handler. The flaw occurs when processing a long MAIL FROM field, allowing an attacker to overwrite stack memory. No authentication is required to trigger the vulnerability.

Exploitation

An attacker can send a crafted SMTP MAIL FROM command with an oversized value (e.g., 1019 bytes) to the target server on TCP port 25. As demonstrated in [2], this overwrites the instruction pointer allowing control of program execution. The exploit may require adjusting buffer sizes and return addresses depending on the target environment.

Impact

Successful exploitation leads to arbitrary code execution under the privileges of the eXchange POP3 service. This could compromise the entire Exchange server, leading to complete disclosure, modification, or destruction of data.

Mitigation

The issue is fixed in build 5.0.1629 [1]. Users should upgrade to this version or later from the vendor's download page. No workarounds are documented.