bugtraq - EasyMail Objects v6.5 Connect Method Stack Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <000801c75149$a4da9780$2201a8c0@meths>
Date: Fri, 16 Feb 2007 10:38:33 +1300
From: "Paul Craig" <paul.craig@...urity-assessment.com>
To: <bugtraq@...urityfocus.com>
Cc: <full-disclosure@...ts.netsys.com>
Subject: EasyMail Objects v6.5 Connect Method Stack Overflow

========================================================================
= EasyMail Objects v6.5 Connect Method Stack Overflow
=
= Vendor Website: 
= http://www.quiksoft.com
=
= Affected Version:
= All versions of EasyMail Objects prior to v6.5 
=
= Public disclosure on February 16th, 2007.
========================================================================

== Overview ==

During a security review of the safe-for-scripting EasyMail objects,
a stack overflow was discovered in the connect method of EasyMail IMAP4 
(Object ClassID {703B353E-FA2E-4072-8DDF-F70AAC7E527E}).
This advisory is also available online at 
http://www.security-assessment.com/files/advisories/easymail_advisory.pdf

== Exploitation ==

When the object is initialized and the Connect method is called, a stack
overflow is possible when a large (500+ characters) host name is specified.
Once arbitrary data has been written to the stack, it is possible to
overflow the structured exception handler and gain command execution.

== Solutions ==

Security-Assessment.com has been in contact with Quiksoft and a 
new version of the software has been released to address the discovered
vulnerability.

Security-Assessment.com urges EasyMail users to upgrade to the latest
version
which is available at
http://www.quiksoft.com/download/emsetup.exe.

== Credit ==

Discovered and advised to Quiksoft February, 2007 by Paul Craig of
Security-Assessment.com

== About Security-Assessment.com ==

Security-Assessment.com is Australasia's leading team of Information 
Security consultants specialising in providing high quality Information 
Security services to clients throughout the Asia Pacific region. Our 
clients include some of the largest globally recognised companies in 
areas such as finance, telecommunications, broadcasting, legal and 
government. Our aim is to provide the very best independent advice and 
a high level of technical expertise while creating long and lasting 
professional relationships with our clients.

Security-Assessment.com is committed to security research and 
development, and its team continues to identify and responsibly publish 
vulnerabilities in public and private software vendor's products. 
Members of the Security-Assessment.com R&D team are globally recognised 
through their release of whitepapers and presentations related to new 
security research.

Security-Assessment.com is an Endorsed Commonwealth Government of 
Australia supplier and sits on the Australian Government 
Attorney-General's Department Critical Infrastructure Project panel. 
We are certified by both Visa and MasterCard under their Payment 
Card Industry Data Security Standard Programs.