[VulnWatch] Multiple Buffer Overflow Vulnerabilities in SLMail (#NISR07052003A)

From: NGSSoftware Insight Security Research (nisr_at_nextgenss.com)
Date: 05/07/03

  • Next message: NGSSoftware Insight Security Research: "[VulnWatch] Multiple Vulnerabilities in SLWebmail"
    To: <ntbugtraq@listserv.ntbugtraq.com>, <bugtraq@securityfocus.com>, <vulnwatch@vulnwatch.org>
    Date: Wed, 7 May 2003 17:44:22 +0100
    
    

    NGSSoftware Insight Security Research Advisory

    Name: Multiple Buffer Overflows in SLMail
    Systems Affected: SLMail 5.1.0.4420 on Windows
    Severity: High Risk
    Vendor URL: http://www.slmail.com
    Authors: David Litchfield (david@ngssoftware.com)
     Mark Litchfield (mark@ngssoftware.com)
    Date: 7th May 2003
    Advisory URL: http://www.nextgenss.com/advisories/slmail-vulns.txt
    Advisory number: #NISR07052003A

    Description
    ***********
    SLMail is described by the vendor as a "security conscious Windows NT / 2000
    email server". The SMTP engine, poppasswd and pop3 server of SLMail suffer
    from multiple remotely exploitable buffer overflow vulnerabilities.

    Details
    *******
    SMTP Engine Buffer Overflows

    By supplying an overly long parameter to the ETRN command the saved return
    address on the stack is overwritten due to a classic stack based overflow
    vulnerability - the result of an unsafe call to the lstrcat() function. This
    can only be exploited by first greeting the server using EHLO, however, as
    opposed to the older HELO.

    Whilst the process that listens on TCP port 25 (the SMTP port) is
    slsmtp.exe - the vulnerable process is slmail.exe. slsmtp.exe simply passes
    any input to slmail.exe for processing.

    On overflowing the buffer and overwriting the saved return address with an
    address that contains a "jmp esp" instruction it is possible to divert the
    flow of execution into the user supplied buffer and thus execute arbitrary
    code. By default SLMail runs as a service in the security context of the
    SYSTEM account. As such complete control over the operating system can be
    gained.

    The XTRN command is also known to be vulnerable.

    POPPASSWD Buffer Overflow
    By connecting to TCP port 106 and supplying an overly string a saved return
    address is overwritten on the stack. Again this is exploitable.

    POP3 Server Buffer Overflow
    By supplying an overly long password when attempting authentication a saved
    return address is overwritten on the stack.

    Fix Information
    ***************
    NGSSoftware alerted SLMail to most of these issues in early Februray, some
    earlier, and a patch through an upgrade has been released. See
    http://www.slmail.com for more details.

    If upgrading is not an option then NGSSoftware recommends that steps be
    taken to mitigate the risk by only allowing access to the POPPASSWD and POP3
    server from "inside" the firewall. "External" access can be provided
    allowing clients to connect via an authenticated VPN to the DMZ and then to
    the POP services from there.

    By disabling ESMTP and allowing only SMTP one can protect against the SMTP
    attacks. ESMTP can be turned off using the SLMail Configuration Utility.

    Further, the SLMail server does not require SYSTEM or administrator
    privileges to run. To minimize the risk of exploitation of these
    vulnerabilities it is suggested than a low privileged account is created to
    be used to run the services. Once an account has been created it must given
    the correct NTFS and registry permissions - otherwise the server will fail
    to start correctly.

    To create an account open a command prompt and issue a command such as the
    following, though choosing a different password:

    C:\>net user slmail 5T@r*m4N!nsKy~ /add

    Then add this account to the local "guests" group:

    C:\>net localgroup guests slmail /add

    And finally remove it from the "users" group:

    C:\> net localgroup users slmail /del

    Once created and the appropriate groups have been assigned/removed, open the
    Registry Editor (Regedt32) and navigate to and highlight

    "HKEY_LOCAL_MACHINE\Software\Seattle Lab"

    On the "Menu" bar select "Security" then "Permissions" then add the "slmail"
    user assigning it "full control" to this key and all subkeys. Once done
    close the Registry Editor.

    Then through Windows Explorer, navigate to the SLMail install directory.
    This is typically

    C:\Program files\SLMail

    Right Click on this directory, select "Properties" and then the "Security"
    Tab. Add the "slmail" user assigning the account "full control" to this
    directory, its subdirectories and files.

    Lastly open the Control Panel/Administrative Tools and select "Services".
    Find the entries for "Seattle Lab POP3 Server" and "Seattle Lab SMTP
    Server". Set these services to log on using the "slmail" account. Stop and
    restart the services for the changes to take effect.

    A check for these issues has been added to Typhon, a comprehensive automated
    vulnerability assessment tool of which more information is available from
    the NGSSite: http://www.ngssoftware.com/

    About NGSSoftware
    *****************
    NGSSoftware design, research and develop intelligent, advanced application
    security assessment scanners. Based in the United Kingdom, NGSSoftware have
    offices in the South of London and the East Coast of Scotland. NGSSoftware's
    sister company NGSConsulting, offers best of breed security consulting
    services, specialising in application, host and network security
    assessments.

    http://www.ngssoftware.com/
    http://www.ngsconsulting.com/

    Telephone +44 208 401 0070
    Fax +44 208 401 0076

    enquiries@ngssoftware.com


  • Next message: NGSSoftware Insight Security Research: "[VulnWatch] Multiple Vulnerabilities in SLWebmail"

    Relevant Pages