On Thu, 18 Nov 2004, [iso-8859-1] Jérôme ATHIAS wrote: : SLMail 5.x POP3 Remote Pass Buffer Overflow Exploit : : http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0942 CAN-2004-0942 (under review) Description Apache webserver 2.0.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request with a MIME header containing multiple lines with a large number of space characters. Perhaps you meant CAN-2003-0264: Multiple buffer overflows in SLMail 5.1.0.4420 allows remote attackers to execute arbitrary code via (1) a long EHLO argument to slmail.exe, (2) a long XTRN argument to slmail.exe, (3) a long string to POPPASSWD, or (4) a long password to the POP3 server. Or is this a new/different issue?
