[NT] Multiple Buffer Overflows in SLMail
From: SecuriTeam (support_at_securiteam.com)
Date: 05/11/03
- Previous message: SecuriTeam: "[NT] Multiple Vulnerabilities in Mirabilis ICQ Client"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 11 May 2003 20:15:35 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
In the US?
Contact Beyond Security at our new California office
housewarming rates on automated network vulnerability
scanning. We also welcome ISPs and other resellers!
Please contact us at: 323-882-8286 or ussales@beyondsecurity.com
- - - - - - - - -
Multiple Buffer Overflows in SLMail
------------------------------------------------------------------------
SUMMARY
<http://www.slmail.com> SLMail is described by the vendor as a "security
conscious Windows NT / 2000 email server". The SMTP engine, poppasswd and
pop3 server of SLMail suffer from multiple remotely exploitable buffer
overflow vulnerabilities.
DETAILS
Vulnerable systems:
* SLMail version 5.1.0.4420
SMTP Engine Buffer Overflows
By supplying an overly long parameter to the ETRN command the saved return
address on the stack is overwritten due to a classic stack based overflow
vulnerability - the result of an unsafe call to the lstrcat() function.
This can only be exploited by first greeting the server using EHLO,
however, as opposed to the older HELO.
Whilst the process that listens on TCP port 25 (the SMTP port) is
slsmtp.exe - the vulnerable process is slmail.exe. slsmtp.exe simply
passes any input to slmail.exe for processing.
On overflowing the buffer and overwriting the saved return address with an
address that contains a "jmp esp" instruction it is possible to divert the
flow of execution into the user supplied buffer and thus execute arbitrary
code. By default, SLMail runs as a service in the security context of the
SYSTEM account. As such, complete control over the operating system can be
gained.
The XTRN command is also known to be vulnerable.
POPPASSWD Buffer Overflow
By connecting to TCP port 106 and supplying an overly string a saved
return address is overwritten on the stack. Again, this is exploitable.
POP3 Server Buffer Overflow
By supplying an overly long password when attempting authentication a
saved return address is overwritten on the stack.
Fix Information
NGSSoftware alerted SLMail to most of these issues in early February, some
earlier, and a patch through an upgrade has been released. See
<http://www.slmail.com> http://www.slmail.com for more details.
If upgrading is not an option then NGSSoftware recommends that steps be
taken to mitigate the risk by only allowing access to the POPPASSWD and
POP3 server from "inside" the firewall. "External" access can be provided
allowing clients to connect via an authenticated VPN to the DMZ and then
to the POP services from there.
By disabling ESMTP and allowing only SMTP, one can protect against the
SMTP attacks. ESMTP can be turned off using the SLMail Configuration
Utility.
Further, the SLMail server does not require SYSTEM or administrator
privileges to run. To minimize the risk of exploitation of these
vulnerabilities it is suggested than a low privileged account is created
to be used to run the services. Once an account has been created, it must
given the correct NTFS and registry permissions - otherwise the server
will fail to start correctly.
To create an account open a command prompt and issue a command such as the
following, though choosing a different password:
C:\>net user slmail 5T@r*m4N!nsKy~ /add
Then add this account to the local "guests" group:
C:\>net localgroup guests slmail /add
And finally remove it from the "users" group:
C:\> net localgroup users slmail /del
Once created and the appropriate groups have been assigned/removed, open
the Registry Editor (Regedt32) and navigate to and highlight
"HKEY_LOCAL_MACHINE\Software\Seattle Lab"
On the "Menu" bar select "Security" then "Permissions" then add the
"slmail" user assigning it "full control" to this key and all subkeys.
Once done close the Registry Editor.
Then through Windows Explorer, navigate to the SLMail install directory.
This is typically
C:\Program files\SLMail
Right Click on this directory, select "Properties" and then the "Security"
Tab. Add the "slmail" user assigning the account "full control" to this
directory, its subdirectories and files.
Lastly open the Control Panel/Administrative Tools and select "Services".
Find the entries for "Seattle Lab POP3 Server" and "Seattle Lab SMTP
Server". Set these services to log on using the "slmail" account. Stop and
restart the services for the changes to take effect.
ADDITIONAL INFORMATION
The information has been provided by <mailto:david@ngssoftware.com> David
Litchfield and <mailto:mark@ngssoftware.com> Mark Litchfield.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[NT] Multiple Vulnerabilities in Mirabilis ICQ Client"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
