SMTP Overrun attack

[olaf.krause]

I wrote a small method that should send mails to the wingate server but wingate says: ...command buffer that was too long (Overrun attack). What exactly does that message mean?

c# code

Code:

               
MailMessage mail = new MailMessage(new MailAddress("from@from.de"),  new MailAddress("to@to.de"));

mail.Subject = "SUB";
mail.Body = "BODY";

SmtpClient client = new SmtpClient("smtp", 25);
client.Credentials = System.Net.CredentialCache.DefaultNetworkCredentials;
 try
{
       client.Send(mail);
}


[olaf.krause]

client.Credentials = System.Net.CredentialCache.DefaultNetworkCredentials;

caused it, since then NTML is used.

ciao

[adrien]

Hi

NTLM should work. Do you have a debug log on the SMTP server you can send?

Adrien

[olaf.krause]

Hi

NTLM should work. Do you have a debug log on the SMTP server you can send?

Adrien

Code:

10/03/06 18:34:03   192.168.0.10   Guest   0000008494   Debug:   <=S: 220 research.ok-edv.de ESMTP Service ready
10/03/06 18:34:03   192.168.0.10   Guest   0000008494   Debug:   C=>: EHLO vista
10/03/06 18:34:03   192.168.0.10   Guest   0000008494   Debug:   <=S: 250-research.ok-edv.de greets you
10/03/06 18:34:03   192.168.0.10   Guest   0000008494   Debug:   <=S: 250-AUTH NTLM
10/03/06 18:34:03   192.168.0.10   Guest   0000008494   Debug:   <=S: 250 SIZE 0
10/03/06 18:34:04   192.168.0.10   Guest   0000008494   Debug:   C=>: AUTH ntlm TlRMTVNTUAABAAAAB7IIoggACAAtAAAABQAFACgAAAAGAOAVAAAAD1ZJU1RBUkVTRUFSQ0g=
10/03/06 18:34:04   192.168.0.10   Guest   0000008494   Debug:   C=>: TlRMTVNTUAABAAAAB7IIoggACAAtAAAABQAFACgAAAAGAOAVAAAAD1ZJU1RBUkVTRUFSQ0g=
10/03/06 18:34:04   192.168.0.10   Guest   0000008494   Debug:   <=S: 334 TlRMTVNTUAACAAAAEAAQADgAAAAFgomi4TuNv/AJBfEAAAAAAAAAAKoAqgBIAAAABQLODgAAAA9SAEUAUwBFAEEAUgBDAEgAAgAQAFIARQBTAEUAQQBSAEMASAABAAoAWABFAE4ATwBOAAQAJAByAGUAcwBlAGEAcgBjAGgALgBvAGsALQBlAGQAdgAuAGQAZQADADAAeABlAG4AbwBuAC4AcgBlAHMAZQBhAHIAYwBoAC4AbwBrAC0AZQBkAHYALgBkAGUABQAkAHIAZQBzAGUAYQByAGMAaAAuAG8AawAtAGUAZAB2AC4AZABlAAAAAAA=
10/03/06 18:34:04   192.168.0.10   Guest   0000008494   Debug:   <=S: 421 Buffer overrun attacks are not welcome here. Goodbye

[adrien]

OK, that's a bug.

depending on your network environment (i.e. domains vs workgroups etc, OS etc) the NTLM packets which are encoded into those big chunks can get quite big, and I guess are getting bigger than the line length limit we set on SMTP. The SMTP spec puts a line limit in of 255 characters, but we will have to extend that.

Adrien