NGSSoftware Insight Security Research Advisory

Name: Multiple Buffer Overflows in SLMail
Systems Affected: SLMail 5.1.0.4420 on Windows
Severity: High Risk
Vendor URL: http://www.slmail.com
Authors: David Litchfield (david@ngssoftware.com)
 Mark Litchfield (mark@ngssoftware.com)
Date: 7th May 2003
Advisory URL: http://www.nextgenss.com/advisories/slmail-vulns.txt
Advisory number: #NISR07052003A

Description
***********
SLMail is described by the vendor as a "security conscious Windows NT / 2000
email server". The SMTP engine, poppasswd and pop3 server of SLMail suffer
from multiple remotely exploitable buffer overflow vulnerabilities.

Details
*******
SMTP Engine Buffer Overflows

By supplying an overly long parameter to the ETRN command the saved return
address on the stack is overwritten due to a classic stack based overflow
vulnerability - the result of an unsafe call to the lstrcat() function. This
can only be exploited by first greeting the server using EHLO, however, as
opposed to the older HELO.

Whilst the process that listens on TCP port 25 (the SMTP port) is
slsmtp.exe - the vulnerable process is slmail.exe. slsmtp.exe simply passes
any input to slmail.exe for processing.

On overflowing the buffer and overwriting the saved return address with an
address that contains a "jmp esp" instruction it is possible to divert the
flow of execution into the user supplied buffer and thus execute arbitrary
code. By default SLMail runs as a service in the security context of the
SYSTEM account. As such complete control over the operating system can be
gained.

The XTRN command is also known to be vulnerable.

POPPASSWD Buffer Overflow
By connecting to TCP port 106 and supplying an overly string a saved return
address is overwritten on the stack. Again this is exploitable.

POP3 Server Buffer Overflow
By supplying an overly long password when attempting authentication a saved
return address is overwritten on the stack.

Fix Information
***************
NGSSoftware alerted SLMail to most of these issues in early Februray, some
earlier, and a patch through an upgrade has been released. See
http://www.slmail.com for more details.

If upgrading is not an option then NGSSoftware recommends that steps be
taken to mitigate the risk by only allowing access to the POPPASSWD and POP3
server from "inside" the firewall. "External" access can be provided
allowing clients to connect via an authenticated VPN to the DMZ and then to
the POP services from there.

By disabling ESMTP and allowing only SMTP one can protect against the SMTP
attacks. ESMTP can be turned off using the SLMail Configuration Utility.

Further, the SLMail server does not require SYSTEM or administrator
privileges to run. To minimize the risk of exploitation of these
vulnerabilities it is suggested than a low privileged account is created to
be used to run the services. Once an account has been created it must given
the correct NTFS and registry permissions - otherwise the server will fail
to start correctly.

To create an account open a command prompt and issue a command such as the
following, though choosing a different password:

C:\>net user slmail 5T@r*m4N!nsKy~ /add

Then add this account to the local "guests" group:

C:\>net localgroup guests slmail /add

And finally remove it from the "users"  group:

C:\> net localgroup users slmail /del

Once created and the appropriate groups have been assigned/removed, open the
Registry Editor (Regedt32) and navigate to and highlight

"HKEY_LOCAL_MACHINE\Software\Seattle Lab"

On the "Menu" bar select "Security" then "Permissions" then add the "slmail"
user assigning it "full control" to this key and all subkeys. Once done
close the Registry Editor.

Then through Windows Explorer, navigate to the SLMail install directory.
This is typically

C:\Program files\SLMail

Right Click on this directory, select "Properties" and then the "Security"
Tab. Add the "slmail" user assigning the account "full control" to this
directory, its subdirectories and files.

Lastly open the Control Panel/Administrative Tools and select "Services".
Find the entries for "Seattle Lab POP3 Server" and "Seattle Lab SMTP
Server". Set these services to log on using the "slmail" account. Stop and
restart the services for the changes to take effect.

A check for these issues has been added to Typhon, a comprehensive automated
vulnerability assessment tool of which more information is available from
the NGSSite: http://www.ngssoftware.com/

About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware have
offices in the South of London and the East Coast of Scotland. NGSSoftware's
sister company NGSConsulting, offers best of breed security consulting
services, specialising in application, host and network security
assessments.

http://www.ngssoftware.com/
http://www.ngsconsulting.com/

Telephone +44 208 401 0070
Fax +44 208 401 0076

enquiries@ngssoftware.com