Luigi Auriemma has discovered some vulnerabilities in Now SMS/MMS Gateway, which can be exploited by malicious people to compromise a vulnerable system.

1) A boundary error in the web interface when processing HTTP requests can be exploited to cause a stack-based buffer overflow via an HTTP request with an overly long "Authorization" header string.

Successful exploitation allows execution of arbitrary code.

2) A boundary error in the SMPP server when processing SMPP packets can be exploited to cause a stack-based buffer overflow via a specially crafted SMPP packet.

Successful exploitation allows execution of arbitrary code but requires that the SMPP server is enabled and a specific port is set.

The vulnerabilities are confirmed in version 2007.06.27. Prior versions may also be affected.

Solution
Update to version 2008.02.22.
Further details available to Secunia VIM customers

Provided and/or discovered by
Luigi Auriemma

Changelog
Further details available to Secunia VIM customers

Original Advisory
Luigi Auriemma:
http://aluigi.altervista.org/adv/nowsmsz-adv.txt

NowSMS:
http://blog.nowsms.com/2008/02/nowsms-2008-and-important-security.html

Deep Links
Links available to Secunia VIM customers