Georgi Guninski has reported a vulnerability in qmail, which can be exploited to crash the current SMTP session.

The vulnerability is caused due to errors in the handling of certain extremely large SMTP sessions (2 GB).

However, one specific attack vector seems to cause a buffer overflow, which overwrites certain structures in memory. Successful exploitation may therefore theoretically allow execution of arbitrary code on a vulnerable system. This has not been confirmed at present, though.

The vulnerability has been reported in version 1.03.

This advisory will be updated as more information becomes available.

Solution
Set an adequate maximum restriction for message sizes (less than 2 GB).
Further details available in Customer Area

Provided and/or discovered by
Georgi Guninski

Original Advisory
http://www.guninski.com/qmailcrash.html

Deep Links
Links available in Customer Area