full-disclosure - eXtremail-v9

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 20 Apr 2007 13:44:40 +0100
From: mu-b <mu-b@...it-labs.org>
To: full-disclosure@...ts.grok.org.uk
Subject: eXtremail-v9

The attached POC exploits a trivial stack smash in the DNS parsing code
of eXtremail versions <= 2.1.1 (current). The POC attached is rather
trivial in that it simply answers queries with a suitable response
(to exhibit the overflow).

However, the problem is further compounded by the fact that eXtremail
neglects to even verify the validity of the transaction id in any
responses, and thus is trivially vulnerable to DNS spoofing attacks
(I am *pretty* sure a more *inventive* method of exploitation exists
to yield trivial remote root...).

Program received signal SIGSEGV, Segmentation fault.
0xdeadbeef in ?? ()
(gdb) bt
#0  0xdeadbeef in ?? ()
#1  0x3031002e in ?? ()
#2  0x00003634 in ?? ()
#3  0x00000000 in ?? ()
(gdb)

POC: http://www.digit-labs.org/files/exploits/extremail-v9.c
-- 
mu-b
(mu-b@...it-labs.org)

  "Only a few people will follow the proof. Whoever does will
     spend the rest of his life convincing people it is correct."
        - Anonymous, "P ?= NP"

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/