The problem comes in with attachments of 2.1 megs ar higher. keep attachments below 2.1 megs in size to mitigate this issue. Since most attachments are smaller than this this is no longer a serious issue(there will be exceptions in some installations) here is the updated advisory..again this is not longer a DOS as for the most part it is solve. I also state this could be an issue due to the low cpu i am using as well. I do not have higher leve hardware to test with. I ask the community to test this and post here if they see the same issue.
Please note updates to test below:
Subject: CPU process exhaustion leading to POP3 error.
Importance:LOW
Tested Hardware: p-2 350 with 192 megs ram.
system parameters: system loads stay below 1.0(averaging .6-.9) with
spikes to 1.3 or so during midnight logs compression runs.
number of ips in use:2
configuration: http proxy, dns proxy, NAT, pop3 proxy with two mail
addresses in expression filter and 6 file types in attachment filter
with no a/v license, DHCP.
versions vulnerable: v5.003
Mail clients tested: mozilla 1.6 mail client( with 6 pop3 accounts installed..all 6 checked upon startup.), Outlook Express 6 sp1
The error manifests itself only under mozila due to mozilla's ability to simultaneously check all accounts instead of each on serially as in Outlook Express. This simultaneous checking of all accounts accuratly simulates multiple users check their mail at the same time. Pop3 error manifest itself under Outlook express upon completing of first pop3 account with large attachment and fails on the second pop3 account.
versions possibly affectede but not tested: v5.000-v5.002
Error type: cpu exhaustion of processe's resources
leading to inability to retrieve further pop3 messages.
System Wide effects: none
parameters: have pop3 proxy set to scan all pop3
traffic with file attachment filter active...a/v does not
have to be on for this to take effect.
Attachment sizes tested: 1.28 megs and 2.1 megs.
compose an e-mail then attach a file at least 2.1 megs in
size. Send it to an external pop3 accounts. now use a mail client to chec those
pop3 accounts. The instant the pop3 proxy gets that mail that pop3 session will hang on that message and cpu load will skyrocket leading to an error of proxy error: basic_ios:[:(]iostate) caused exception. Pop 3 proxy then dies and no more pop3 mail can be retrieved. Attachments 1.28 megs in size and lower make the pop3 scanner go really slow but does not lead to the errors noted.
Aggravating factors: if multiple pop3 accesses are being
performed this
cpu loading effect is cumulative. I have tried this with 5 pop3
accounts at once and was able to bring pop3(mr. popper) to a halt to where no more pop3 checks were able to be performed. I had to shut down the pop3 proxy from webadmin. I then was able to download all pop3 accounts to clear the attachments. I was then able to bring the pop3 proxy back up with no apparent ill effect.
Workarounds: disable pop3 proxy, disallow all attachments on network, keep all attachments under 2.1 megs in size.
This thread was automatically locked due to age.
