Executive brief
Stalker Internet Mail Server is a software application used to manage and deliver corporate email. A vulnerability in version 1.6 allows a remote individual to crash the mail service by sending a specially crafted, overly long command. This results in a total loss of email availability for the organization until the service is manually restarted.
Technical details
A denial of service vulnerability exists in Stalker Internet Mail Server 1.6 due to improper handling of the SMTP HELO command. By sending an excessively long string within the HELO command, a remote, unauthenticated attacker can trigger a buffer overflow or similar memory corruption that causes the mail service to crash. This attack is conducted over the network and requires no user interaction or prior authentication. The primary impact is the disruption of mail delivery services.
Affected products
- Stalker Internet Mail Server 1.6
Timeline
- 1998-04-08: disclosed