Rule:--Sid:3654--Summary:This event is generated when an attempt is made to exploit a denial ofservice or buffer overflow associated with the MDaemon mail server.--Impact:A successful attack may permit a denial of service or buffer overflowthat allows the execution of arbitrary code with system privileges.--Detailed Information:MDaemon is a Windows-based mail server.  A vulnerability exists in theMDaemon SMTP server, possibly allowing a denial of service of executionof arbitrary code with system privileges.  The vulnerability isassociated with passing overly long arguments to the SOML, SAML, SEND,or MAIL commands.--Affected Systems:	MDaemon 6.7.9.1 and prior--Attack Scenarios:An attacker can send a malicious SMTP payload with an overly longargument to the SOML, SAML, SEND, or MAIL commands, possibly causing adenial of service or a buffer overflow and the subsequent execution ofarbitrary code with system privileges on the vulnerable server.--Ease of Attack:Simple.--False Positives:It may be possible for this alert to fire when a command such as SEND,or MAIL is found in the data portion of the SMTP transfer instead of asan actual command.--False Negatives:None known.--Corrective Action:Upgrade to the latest non-affected version of the software.--Contributors:Sourcefire Vulnerability Research TeamJudy Novak <judy.novak@sourcefire.com>--Additional References:--