Twenty Year Anniversary

0x36.smartmax

0x36.smartmax
Posted May 23, 2003
Authored by Mark Litchfield, Matrix

Mailmax Version 5 has a buffer overflow condition in its IMAP4 server that can cause the service to stop responding and allows a remote attacker to overwrite the exception handler on the stack. Doing this could allow arbitrary code execution as the SYSTEM user.

tags | advisory, remote, overflow, arbitrary, code execution
MD5 | 8e2091f8285d63a80ce395cea651ee84

0x36.smartmax

Change Mirror Download
    ____        ,_____   __ 
/ \ |___ / / / Buffer Overflow Vulnerability
( /\ ) / / / / __ Found in MailMax Version 5
( \/ ) \ / ,_\ \ ( ( \ \ http://www.smartmax.com
\____/ / \ |____\ \_\_/_/ matrix at 0x36.org
ooOOooOOooOOooOOooOOooOOooOOooOOooOOooOOooOOooOOooOOooOOooOOooOOooOOooOOooOOoo


<[SUMMARY]>-------------------------------------------------------------------
This is a scalable e-mail server that supports SMTP, IMAP4 and POP3 protocols.
Its TCP/IP GUI allows server administration from any Internet connected server.
The Web Admin module allows you to define domain administrators so they can
Maintain their own accounts. It also provides anti-spamming options.

The problem is a Buffer Overflow in the IMAP4 protocol, within the
IMAP4rev1 SmartMax IMAPMax 5, causing the service to stop responding
and we can actually overwrite the exception handler on the stack allowing
a system compromise with code execution running as SYSTEM.

<[AFFECTED SYSTEMS]>----------------------------------------------------------
Vulnerable systems:
* IMAP4rev1 SmartMax IMAPMax 5 (5.0.10.8)

Immune systems:
* IMAP4rev1 SmartMax IMAPMax 5.5

<[SEVERITY]>------------------------------------------------------------------
Medium/High - An attacker is able to cause a DoS attack on the IMAP protocol
The reason this is also a medium is that and attacker has to have
a login on the system to conduct this attack.
And we can actually overwrite the exception handler on the stack
allowing a system compromise with code execution running as SYSTEM

<[DESCRIPTION OF WHAT THE VULNERABILITY IS]>----------------------------------
The Vulnerability is a Buffer Overflow in the IMAP4rev1 SmartMax IMAPMax 5
When a malicious attacker sends a large amount into the SELECT command.
The buffer will overflow. Sending to many bytes into the buffer will cause the
server to reject the request and nothing will happend.


The following transcript demonstrates a sample exploitation of the
vulnerabilities

--------[ transcript ]-------
nc infowarfare.dk 143
* OK IMAP4rev1 SmartMax IMAPMax 5 Ready
0000 CAPABILITY
* CAPABILITY IMAP4rev1
0000 OK CAPABILITY completed
0001 LOGIN "RealUser@infowarfare.dk" "HereIsMyPassword"
0001 OK User authenticated.
0002 SELECT "aaa...[256]...aaaa"
--------[ transcript ]-------

When this attack is used there will pop-up a message box on the server, with
the text "Buffer overrun detected! - Program: <PATH>\IMAPMax.exe" at this time
the service shuts down, and has to be restarted manually, from the service
manager.


<[DETECTION]>----------------------------------------------------------------
IMAP4rev1 SmartMax IMAPMax 5 is vulnerable to the above-described attacks.
Earlier versions may be susceptible as well. To determine if a specific
implementation is vulnerable, experiment by following the above transcript.


<[WORK AROUNDS]>-------------------------------------------------------------
The only work around if you do not want to update your system is to disable
the IMAP service, else i would higly recommend updating to version 5.5 of
MailMAX


<[VENDOR RESPONSE]>----------------------------------------------------------
it's fixed in 5.5, to be released by May 10th.
5.5 is the update to 5.0. It is a free upgrade for owners of 5.0.
Regards,
Eric Weber


<[DISCLOSURE TIMELINE]>------------------------------------------------------
11/04/2003 Recived a mail from Mark Litchfield, about this could be vulnerable
by sending a larger buffer. So credits should also go to Mark
15/04/2003 Made an analysis and found the vulnerability
28/04/2003 Reported the vulnerability to Vendor (support-at-smartmax.com)
02/05/2003 Recived responce from Vendor
17/05/2003 Public Disclosure.


<[ADDITIONAL INFORMATION]>---------------------------------------------------
The vulnerability was discovered and reported by <Matrix at 0x36.org>


<[DISCLAIMER]>---------------------------------------------------------------
The information in this bulletin is provided "AS IS" without warranty of any
kind. In no event shall we be liable for any damages whatsoever including
direct, indirect, incidental, consequential, loss of business profits or
special damages.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

May 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    15 Files
  • 2
    May 2nd
    17 Files
  • 3
    May 3rd
    30 Files
  • 4
    May 4th
    29 Files
  • 5
    May 5th
    2 Files
  • 6
    May 6th
    3 Files
  • 7
    May 7th
    13 Files
  • 8
    May 8th
    27 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    15 Files
  • 11
    May 11th
    8 Files
  • 12
    May 12th
    2 Files
  • 13
    May 13th
    8 Files
  • 14
    May 14th
    7 Files
  • 15
    May 15th
    43 Files
  • 16
    May 16th
    19 Files
  • 17
    May 17th
    16 Files
  • 18
    May 18th
    15 Files
  • 19
    May 19th
    3 Files
  • 20
    May 20th
    7 Files
  • 21
    May 21st
    15 Files
  • 22
    May 22nd
    40 Files
  • 23
    May 23rd
    61 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close