Mercury SMTPD CRAM-MD5 Pre-Auth Buffer Overflow Exploit

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of software utilizing the Mercury Mail Transport System. The vulnerability is caused due to a boundary error within Mercury/32 SMTP Server Module (mercurys.dll) when processing arguments to the AUTH CRAM-MD5 command. This can be exploited to cause a stack-based buffer overflow via an overly long, specially-crafted argument passed to the affected command. Authentication is not required to exploit this vulnerability.
Exploit type: 
Platform: 
Vulnerabilty ID: 
CVE-2007-4440
Product Version: 
7.5
Released Date: 
Friday, February 15, 2008 - 00:00