Portcullis Security Advisory 06-060


Vulnerable System:

SurgeMail.


Vulnerability Title:

SurgeMail is prone to a format string vulnerability.


Vulnerability discovery and development: 

Portcullis Security Testing Services discovered this vulnerability. 
Further research was then carried out.


Credit For Discovery:

Nico Leidecker - Portcullis Computer Security Ltd.


Affected systems: 

Version 3.7b8 Linux and maybe previous versions and on other platforms.


Details:

SurgeMail offers the ability to charge the recipients a fee for receiving 
emails from certain addresses. As soon as such an email comes in, a 
notification email containing the amount payable is composed and sent to the 
user requesting payment.  A user with the privileges allowing them to change 
these amounts is then able to exploit a format string vulnerability, caused by 
the abdiction of an explicit format string while using the amount value as 
parameter in such a function. Furthermore, the amount value can consist of 
arbitrary characters.


Impact:

An attacker could cause a Denial of Service or execute arbitrary code in the 
context of the server.


Exploit:

The proof of concept exploit code is available.


Vendor Status:

Vendor notified. The vulnerability has been fixed.


Copyright:

Copyright © Portcullis Computer Security Limited 2005, All rights reserved 
worldwide.

Permission is hereby granted for the electronic redistribution of this 
information. It is not to be edited or altered in any way without the express 
written consent of Portcullis Computer Security Limited.


Disclaimer: 

The information herein contained may change without notice. Use of this 
information constitutes acceptance for use in an AS IS condition. There are NO 
warranties, implied or otherwise, with regard to this information or its use. 
Any use of this information is at the user's risk. In no event shall the 
author/distributor (Portcullis Computer Security Limited) be held liable for 
any damages whatsoever arising out of or in connection with the use or spread 
of this information.