[Full-disclosure] eXtremail-v9

Type securityvulns
Reporter Securityvulns
Modified 2007-04-20T00:00:00


The attached POC exploits a trivial stack smash in the DNS parsing code of eXtremail versions <= 2.1.1 (current). The POC attached is rather trivial in that it simply answers queries with a suitable response (to exhibit the overflow).

However, the problem is further compounded by the fact that eXtremail neglects to even verify the validity of the transaction id in any responses, and thus is trivially vulnerable to DNS spoofing attacks (I am pretty sure a more inventive method of exploitation exists to yield trivial remote root...).

Program received signal SIGSEGV, Segmentation fault. 0xdeadbeef in ?? () (gdb) bt

0 0xdeadbeef in ?? ()

1 0x3031002e in ?? ()

2 0x00003634 in ?? ()

3 0x00000000 in ?? ()


POC: http://www.digit-labs.org/files/exploits/extremail-v9.c

mu-b (mu-b@digit-labs.org)

"Only a few people will follow the proof. Whoever does will spend the rest of his life convincing people it is correct." - Anonymous, "P ?= NP"

Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/