NGSSoftware Insight Security Research Advisory Name: Multiple Buffer Overflows in SLMail Systems Affected: SLMail 5.1.0.4420 on Windows Severity: High Risk Vendor URL: http://www.slmail.com Authors: David Litchfield (davidat_private) Mark Litchfield (markat_private) Date: 7th May 2003 Advisory URL: http://www.nextgenss.com/advisories/slmail-vulns.txt Advisory number: #NISR07052003A Description *********** SLMail is described by the vendor as a "security conscious Windows NT / 2000 email server". The SMTP engine, poppasswd and pop3 server of SLMail suffer from multiple remotely exploitable buffer overflow vulnerabilities. Details ******* SMTP Engine Buffer Overflows By supplying an overly long parameter to the ETRN command the saved return address on the stack is overwritten due to a classic stack based overflow vulnerability - the result of an unsafe call to the lstrcat() function. This can only be exploited by first greeting the server using EHLO, however, as opposed to the older HELO. Whilst the process that listens on TCP port 25 (the SMTP port) is slsmtp.exe - the vulnerable process is slmail.exe. slsmtp.exe simply passes any input to slmail.exe for processing. On overflowing the buffer and overwriting the saved return address with an address that contains a "jmp esp" instruction it is possible to divert the flow of execution into the user supplied buffer and thus execute arbitrary code. By default SLMail runs as a service in the security context of the SYSTEM account. As such complete control over the operating system can be gained. The XTRN command is also known to be vulnerable. POPPASSWD Buffer Overflow By connecting to TCP port 106 and supplying an overly string a saved return address is overwritten on the stack. Again this is exploitable. POP3 Server Buffer Overflow By supplying an overly long password when attempting authentication a saved return address is overwritten on the stack. Fix Information *************** NGSSoftware alerted SLMail to most of these issues in early Februray, some earlier, and a patch through an upgrade has been released. See http://www.slmail.com for more details. If upgrading is not an option then NGSSoftware recommends that steps be taken to mitigate the risk by only allowing access to the POPPASSWD and POP3 server from "inside" the firewall. "External" access can be provided allowing clients to connect via an authenticated VPN to the DMZ and then to the POP services from there. By disabling ESMTP and allowing only SMTP one can protect against the SMTP attacks. ESMTP can be turned off using the SLMail Configuration Utility. Further, the SLMail server does not require SYSTEM or administrator privileges to run. To minimize the risk of exploitation of these vulnerabilities it is suggested than a low privileged account is created to be used to run the services. Once an account has been created it must given the correct NTFS and registry permissions - otherwise the server will fail to start correctly. To create an account open a command prompt and issue a command such as the following, though choosing a different password: C:\>net user slmail 5T@r*m4N!nsKy~ /add Then add this account to the local "guests" group: C:\>net localgroup guests slmail /add And finally remove it from the "users" group: C:\> net localgroup users slmail /del Once created and the appropriate groups have been assigned/removed, open the Registry Editor (Regedt32) and navigate to and highlight "HKEY_LOCAL_MACHINE\Software\Seattle Lab" On the "Menu" bar select "Security" then "Permissions" then add the "slmail" user assigning it "full control" to this key and all subkeys. Once done close the Registry Editor. Then through Windows Explorer, navigate to the SLMail install directory. This is typically C:\Program files\SLMail Right Click on this directory, select "Properties" and then the "Security" Tab. Add the "slmail" user assigning the account "full control" to this directory, its subdirectories and files. Lastly open the Control Panel/Administrative Tools and select "Services". Find the entries for "Seattle Lab POP3 Server" and "Seattle Lab SMTP Server". Set these services to log on using the "slmail" account. Stop and restart the services for the changes to take effect. A check for these issues has been added to Typhon, a comprehensive automated vulnerability assessment tool of which more information is available from the NGSSite: http://www.ngssoftware.com/ About NGSSoftware ***************** NGSSoftware design, research and develop intelligent, advanced application security assessment scanners. Based in the United Kingdom, NGSSoftware have offices in the South of London and the East Coast of Scotland. NGSSoftware's sister company NGSConsulting, offers best of breed security consulting services, specialising in application, host and network security assessments. http://www.ngssoftware.com/ http://www.ngsconsulting.com/ Telephone +44 208 401 0070 Fax +44 208 401 0076 enquiriesat_private
This archive was generated by hypermail 2b30 : Wed May 07 2003 - 11:41:16 PDT