PMDF Kills Bug Discovered in Popular E-mail Clients; Innosoft's Enterprise Messaging Backbone Protects Users From Potential Malicious Attacks and System Crashes.

WEST COVINA, Calif.--(BUSINESS WIRE)--Aug. 3, 1998--Innosoft International Inc., today announced that it is helping its customers deal with the recently discovered security flaw found in popular e-mail and Web browser client programs from product vendors Microsoft and Netscape.

As disclosed in last week's news reports, this bug makes users of these programs vulnerable to malicious attacks, or may cause their systems to crash unexpectedly, when receiving MIME message attachments with long filenames. The PMDF backbone protects against such potential disasters by sanitizing any message it handles, preventing the bug from being exploited by ensuring that a virus is never delivered to the user's client system.

The Problem is Buffer Overflow Error

According to Innosoft's chief development officer and co-author of the Internet's MIME standard, Ned Freed, "The problem lies in the way Microsoft and Netscape products have been programmed to handle MIME attachments with long filenames. Both vendors are failing to check lengths, which can allow data such as filenames to overflow buffers and seep into sensitive memory areas."

Freed added, "Someone might exploit this design error by executing a virus embedded in a filename, which, for instance, could result in the exposure of sensitive data such as credit card information during a transaction over the Internet using a Web browser. In addition, since virus checkers only look at message content and are oblivious to filenames, such products are rendered useless in this case."

Besides possible security breaches, Innosoft's in-house testing has shown that system crashes are a reality. Microsoft's Outlook Express, for example, allows for filenames of 250 characters or more. Whenever a message was received that had an attachment with a filename of 260 characters, the system crashed consistently.

The Solution is in the Enterprise Backbone

The PMDF e-Mail Interconnect product suite includes an SMTP/MIME-based messaging backbone that is designed to support and integrate multiple departmental mail servers that may be distributed across the enterprise. Besides offering a central point of management over these mail servers, the benefit of using a backbone in the design of a messaging infrastructure is that it can filter out these kinds of bugs before they can be allowed to execute a virus.

Not only is PMDF itself not vulnerable to such buffer overflow attacks, but it also actively protects vulnerable users from the type of security flaws found in the Microsoft and Netscape products. Since PMDF uses counted strings rather than null terminated strings, and truncates rather than overflowing buffers, it eliminates all sorts of potential security problems. Further, PMDF avoids using character pointers, preferring instead to use an array of constructs where run-time bounds checking is possible. This provides two layers of checking in PMDF -- one explicitly coded in the string primitives used, the other provided by the language environment itself.

Freed said, "PMDF has always included extensive MIME handling capabilities that would allow a site to manipulate attachments in such a way as to make them 'safe' for problem clients. What we've done to PMDF that specifically addresses the new bug found in these pervasive mail products is to automatically truncate the field used for filename attachments."

Freed added, "Avoiding this newly discovered security problem is just the latest example of Innosoft's quick response and PMDF's ability to provide additional protection for its customer's enterprise e-mail systems."

Sensitive government sites that are prone to attacks, large ISPs, and Fortune 1000 corporations rely on PMDF protection against denial of service attacks, and unsolicited bulk e-mail storms. These large sites can especially appreciate the benefit of the added level of security that PMDF provides while they wait to install the vendor's recommended patches at each and every client machine. This could be an extremely costly and time-consuming task at a site with say 30,000 users or more.

About Innosoft International

A pioneer in enterprise e-mail solutions since 1987, Innosoft International continues its leadership in the development of Internet standards in both the messaging and directory worlds. Innosoft markets its PMDF e-Mail Interconnect and Innosoft Directory Services product sets directly to end users, as well as through a network of international distributors and solutions partners. Innosoft maintains strategic relationships with Sun Microsystems (Sun licenses the PMDF backbone for their enterprise mail product offering), and with Digital Equipment Corp., who resells PMDF products worldwide. Innosoft's messaging and directory products are presently installed at more than 2,400 sites in 51 countries throughout the world. The company is located at 1050 Lakes Drive, West Covina, CA 91790; telephone [phone]; FAX [phone].

PMDF is a registered trademark of Innosoft International Inc. All other trademarks are property of their respective owners.

    CONTACT:  Innosoft International Inc.
               Dean Hidalgo, 626/919-3600
               [e-mail]
               http://www.innosoft.com
                          OR
               The Townsend Agency
               Carol Foster, 619/457-4888
               [e-mail]