David Colliver napisał(a):
> I am using a fairly old version of ICS from 2002, with Delphi 5. I have not
> done much programming in Delphi since then, but I have become aware of a
> buffer overflow in the SMTP part of my application. At this moment, I don't
> know if it is ICS or my app that is causing it.
We don't know either. BTW: we're in 2007, so your version is "a bit" old
> In the USER or RCPT TO: (I think USER is POP3, not SMTP...) if more than 4000
> bytes are sent, then it apparently causes 100% cpu, DoS and will allow an
> attacker to run commands.
Seems like you're "overscared" by all those today's vulnerabilities,
buffer overflow does not necessarily allow attacker to perform code
injection - and by the way, why do you suppose that it's the "buffer
overflow", not other kind of vulnerability, like infinite loop? Why do
you suppose it's a vulnerablity? It's a bug, no question, but saying
about vulnerability is like saying that you'll die of headache (just
because it's pain).
About your case: who would like to have/use 4kb-sized email address?! If
you can't limit that in your software, check whether component does. If
you mean a group of recipients that take more than 4000 bytes, it may be
a bug in ICS, so you should upgrade your components.
Anyway, it's a good idea to use debugger. When you're at 100% cpu, just
use debugger's "pause" feature and then "step over" or "trace into", to
have a look where and why you're looping.
> As I haven't done anything with ICS or Delphi for a while, I am not sure
> where to look.
> Also, if I download the latest ICS, will there be anything that is likely to
> cause me programming difficulties? Will any buffer overflow vulnerabilities
> been fixed?
Make a copy of your ICS, install new, and check it on your own. Is that
so difficult? Don't expect us to do your homework. We have ours.
.oooO /~) (~\ Oooo. "Programowanie to | Piotr Dałek
( ) / ( ) \ ( ) *najprzyjemniejsza* | [EMAIL PROTECTED]
\ ( ( ) ( ) ) / rzecz, jaką można | http://www.hcm.prv.pl/
\_)'oooO Oooo'(_/ robić w ubraniu" |
Jestes kierowca? To poczytaj! >>> http://link.interia.pl/f199e
To unsubscribe or change your settings for TWSocket mailing list
please goto http://www.elists.org/mailman/listinfo/twsocket
Visit our website at http://www.overbyte.be