[<prev] [next>] [day] [month] [year] [list]
Message-ID: <45D2E0F6.8080904@digit-labs.org>
Date: Wed, 14 Feb 2007 10:14:14 +0000
From: mu-b <mu-b@...it-labs.org>
To: full-disclosure@...ts.grok.org.uk
Subject: MailEnable DoS POC
The POC attached exploits an out of bounds memory read in the NTLM authentication
routines of MailEnable Pro/Enterprise. The problem lies in the NTLM_UnPack_Type3
function of MENTLM.dll.
This appears to have been silently "patched" somewhere between versions 2.351 and
2.36-7. (observe the quotes).
(c34.dc0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=8146930b ebx=003a6cc8 ecx=00000040 edx=00000000 esi=8146920b edi=0146b238
eip=0109b4b3 esp=014691e4 ebp=014691ec iopl=0 nv up ei pl nz ac po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010212
MENTLM!NTLM_UnPack_Type3+0x3019:
0109b4b3 f3a5 rep movs dword ptr es:[edi],dword ptr [esi] es:0023:0146b238=00000000 ds:0023:8146920b=????????
---------------------------------------------------------------------------
(mu-b@...it-labs.org)
View attachment "maildisable-v5.pl" of type "text/x-perl" (1816 bytes)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists