Description (CNA)
Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows allows a local interactive user with no hMailServer credentials to write bytes of their choosing past the end of a 255-byte heap buffer in the hMailServer service process, which runs as LocalSystem by default. The user does this by passing a long hexadecimal string to the COM method Utilities.BlowfishDecrypt, which checked no authentication. The routine converted hexadecimal input of any length into a fixed 255-byte buffer before decrypting it in place. The result is a denial of service (service crash), and possibly code execution with the privileges of the service account.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Progressive Robot Ltd / hMailServer | affected 6.0.0 before 6.3.4 |
CWE
CWE-122
References
- https://gitlab.com/hmailserver/hmailserver/-/commit/135a1908ff820ed587d5f180f98c53bd010d8931
- https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.4
- https://gitlab.com/hmailserver/hmailserver/-/work_items/49
ADP enrichment
No English description supplied.
No references supplied.