full-disclosure - MailEnable DoS POC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <45D2E0F6.8080904@digit-labs.org>
Date: Wed, 14 Feb 2007 10:14:14 +0000
From: mu-b <mu-b@...it-labs.org>
To: full-disclosure@...ts.grok.org.uk
Subject: MailEnable DoS POC

The POC attached exploits an out of bounds memory read in the NTLM authentication
routines of MailEnable Pro/Enterprise. The problem lies in the NTLM_UnPack_Type3
function of MENTLM.dll.

This appears to have been silently "patched" somewhere between versions 2.351 and
2.36-7. (observe the quotes).

(c34.dc0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=8146930b ebx=003a6cc8 ecx=00000040 edx=00000000 esi=8146920b edi=0146b238
eip=0109b4b3 esp=014691e4 ebp=014691ec iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010212
MENTLM!NTLM_UnPack_Type3+0x3019:
0109b4b3 f3a5            rep movs dword ptr es:[edi],dword ptr [esi] es:0023:0146b238=00000000 ds:0023:8146920b=????????

---------------------------------------------------------------------------
(mu-b@...it-labs.org)

View attachment "maildisable-v5.pl" of type "text/x-perl" (1816 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/