[NT] Remote Heap Corruption overflow Vulnerability in MailEnable

From: SecuriTeam (support_at_securiteam.com)
Date: 05/11/04

  • Next message: SecuriTeam: "[REVS] Acoustic Cryptanalysis: On Nosy People and Noisy Machines" 
    To: list@securiteam.com
Date: 11 May 2004 15:26:27 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Remote Heap Corruption overflow Vulnerability in MailEnable
    ------------------------------------------------------------------------

    SUMMARY

    The professional version of MailEnable includes an additional mail access
    service called HTTPMail. HTTPMail is a mail access protocol based on
    WEBDAV that allows you to access your mail from the server without
    downloading the mail (as is often the case with POP). This Service
    (MEHTTPS) listens on port 8080 by default.

    Sending a HTTP request with more than 4045 bytes to MEHTTPS service will
    cause a heap buffer overflow while logging is enable(by default), and it's
    possible for a remote attacker to execute code as SYSTEM or just simply
    crash the service. When Logging is disabled it requires more than 8500
    bytes to cause overflow.

    DETAILS

    Examples:
    Sending as a request (while logging is enabled) will cause the fault to
    occur:
    GET /<4032xA> HTTP/1.1

    Or, sending as a request (logging is disabled) will cause the fault to
    occur:
    <8501xA>

    The result of both these requests is that the EAX and ECX registers are
    overwritten.

    Vendor response:
    MailEnable has released a Hotfix for this issue,
    <http://mailenable.com/hotfix/MEHTTPS.zip>
    http://mailenable.com/hotfix/MEHTTPS.zip.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:behrang@hat-squad.com>
    Behrang Fouladi.

    The original article can be found at:
    <http://www.hat-squad.com/en/000071.html>
    http://www.hat-squad.com/en/000071.html

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[REVS] Acoustic Cryptanalysis: On Nosy People and Noisy Machines"

    Relevant Pages

    • [NEWS] McAfee ePolicy Orchestrator Remote Compromise
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... request, UUID, and computer hostname. ... The data that follows first specifies a directory and xml filename, ... +06h DWORD file offset of XML ...
      (Securiteam)
    • [NEWS] Dedicated Mobile Services Carry Out Anonymous Web Attacks
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... to anonymously browse web resources and execute attacks against them. ... An attacker can take advantage of the Google's WMLProxy Service by sending ... a HTTP GET request with carefully modified URL of a malicious nature. ...
      (Securiteam)
    • [EXPL] Windows 2000 Server UPNP DoS (Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A memory leak with windows 2000 server UPNP allow attackers to exploit ... The earlier one trashed the EIP of the target ... * Strangely though changing the operation number in the DCERPC request to ...
      (Securiteam)
    • [NT] eZ Multiple Packages Stack Overflow Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A stack-based buffer overflow problem seems ... to arise when an overly long request is made to the server, ... saved data which we can overwrite. ...
      (Securiteam)
    • [UNIX] Apache HTTP Server 413 Error Page XSS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Apache HTTP Server 413 Error Page XSS ... Apache 2.X returns a '413 Request Entity Too Large' error, ...
      (Securiteam)