cbcvebase.
CVE-2017-6506
published 2017-03-10

CVE-2017-6506: In Azure Data Expert Ultimate 2.2.16, the SMTP verification function suffers from a buffer overflow vulnerability, leading to remote code execution. The attack…

PriorityP264critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
11.70%
95.5th percentile
In Azure Data Expert Ultimate 2.2.16, the SMTP verification function suffers from a buffer overflow vulnerability, leading to remote code execution. The attack vector is a crafted SMTP daemon that sends a long 220 (aka "Service ready") string.

Affected

1 ranges
VendorProductVersion rangeFixed in
azure_dexdata_expert_ultimate——

Detection & IOCsextracted from sources · hover to see the quote

versionAzure Data Expert Ultimate 2.2.16↗
bytes↗
220 <176*A><shellcode>
  • →Detect a rogue SMTP server sending an abnormally long SMTP 220 'Service ready' banner (>176 bytes) to a connecting client — this is the exploit delivery mechanism. ↗
  • →Alert on SMTP 220 banner responses containing a payload structured as 176 'A' bytes followed by shellcode and the CALL ESP ROP gadget bytes \x5e\x63\x27\x65. ↗
  • →Monitor for Azure Data Expert Ultimate processes initiating outbound TCP connections (reverse meterpreter) after receiving an SMTP 220 banner, particularly to port 4444. ↗
  • →Bad characters \x00, \x0a, \x0d, \x20 are avoided in the shellcode; IDS signatures for this exploit should look for NOP sleds (\x90*8) followed by shellcode within an SMTP 220 response. ↗
  • ·The exploit uses a hardcoded CALL ESP gadget address from QtGui4.dll (0x6527635E); this address is version/build specific and may differ across installations. ↗
  • ·The exploit was tested only on Windows Server 2008 R2 Standard x64; exploit reliability on other Windows versions is not confirmed. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.