Luigi Auriemma has discovered some vulnerabilities in Now SMS/MMS Gateway, which can be exploited by malicious people to compromise a vulnerable system.

1) A boundary error in the web interface when processing HTTP requests can be exploited to cause a stack-based buffer overflow via an HTTP request with an overly long "Authorization" header string.

Successful exploitation allows execution of arbitrary code.

2) A boundary error in the SMPP server when processing SMPP packets can be exploited to cause a stack-based buffer overflow via a specially crafted SMPP packet.

Successful exploitation allows execution of arbitrary code but requires that the SMPP server is enabled and a specific port is set.

The vulnerabilities are confirmed in version 2007.06.27. Prior versions may also be affected.

Solution
Update to version 2008.02.22.
Further details available in Customer Area

Provided and/or discovered by
Luigi Auriemma

Changelog
Further details available in Customer Area

Original Advisory
Luigi Auriemma:
http://aluigi.altervista.org/adv/nowsmsz-adv.txt

NowSMS:
http://blog.nowsms.com/2008/02/nowsms-2008-and-important-security.html

Deep Links
Links available in Customer Area