Resolve QID 118044 for ANSMTP SMTP Component Buffer Overflow Vulnerability

Problem

You can see QID 118044 reported on Windows assets during authenticated scans. The vulnerability title appears as AdminSystem ANSMTP SMTP Component Buffer Overflow Vulnerability. The detection method shows Windows authentication. The scan identifies a specific ANSmtp.dll or AOSmtp.dll version as outdated and vulnerable. You may still see the QID after upgrading the component.

Cause

The vulnerability exists in the AddAttachments() function of the ANSMTP component.
The issue affects ANSmtp.dll versions earlier than 8.0.0.8. Qualys uses authenticated scanning to detect vulnerabilities based on file version. The scanner queries Windows Registry keys to locate the ANSMTP component.

• For 32-bit systems, the scan checks: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\InprocServer32
• For 64-bit systems, the scan checks: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\InprocServer32

The scanner retrieves the DLL path and inspects the file version. If the version is earlier than 8.0.0.8, the QID is triggered. This is a version-based detection. It does not rely on exploit attempts or runtime behavior.

How Qualys Detects This Vulnerability?

Qualys uses authenticated scanning on Windows hosts to detect this vulnerability. The scanner verifies the version of the ANSmtp.dll registered on the system. During the scan, Qualys:

• Queries the Windows Registry to locate the ANSMTP component.
• Reads the DLL path from specific registry keys.
• Extracts the DLL’s product version.
• Flags the asset as vulnerable if the version is earlier than 8.0.0.8.

This is a version-based detection. The scanner does not perform behavior-based or exploit-based checks.

Solution

To fix this vulnerability:

1. Upgrade ANSMTP to version 8.0.0.8 or later. 
   This version contains the fix for the buffer overflow issue.
2. Download the updated version (ansmtp.exe file) from the vendor.

After Upgrading

1. Verify that the registry keys point to the new DLL.
2. Run a follow-up authenticated scan in Qualys.
3. Confirm that QID 118044 is no longer detected.

Next Steps: What to Check on the Affected Asset?

If QID 118044 continues to appear after you update the component, perform the following checks on the affected Windows host.

Verify the Installed DLL Version

1. Log in to the affected Windows system.
2. Open Registry Editor (regedit.exe).
3. Navigate to the registry paths listed in the Detection Logic section.
4. Locate the DLL path listed under InprocServer32.
5. Browse to the DLL file on disk.
6. Open the file properties and check the Product Version.

If the DLL version is earlier than 8.0.0.8, the host is still vulnerable.
If the version is 8.0.0.8 or later, but the QID continues to appear, contact Qualys Support.
Possible causes include cached results or scan scope issues.

Qualys provides detection and remediation guidance based on publicly available information. Qualys does not host or distribute third‑party software, patches, or installers. For installation issues, packaging concerns, or version validation, contact the software vendor or your internal IT application packaging team.

Need Further Help?

If the QID 118044 is still detected after upgrading and validating the DLL path and version, contact Qualys Support.

For faster troubleshooting, provide:

• A screenshot of the DLL properties showing the version
• The registry key path and the DLL it references
• Confirmation that an authenticated scan was successful

Qualys Support helps review detections and ensure accurate reporting.