Novell NetMail IMAPD Command Continuation Request Heap Overflow iDEFENSE Security Advisory 09.01.05 www.idefense.com/application/poi/display?id=301&type=vulnerabilities September 1, 2005 I. BACKGROUND Novell NetMail is an e-mail and calendaring system that is based on Internet-standard messaging and security protocols. More information about Novell NetMail is available from: http://www.novell.com/products/netmail/ II. DESCRIPTION Remote exploitation of a heap overflow vulnerability in Novell Inc.'s NetMail IMAP daemon allows unauthenticated attackers to execute arbitrary code with the privileges of the underlying user. The problem specifically exists in the handling of command continuation requests as the user-specified size value is used directly as the argument to a custom memory allocation wrapper (MMalloc()): 00402CA2 lea ecx, [ebx+1] ; ebx is attacker controlled 00402CA5 push ecx 00402CA6 call MMmalloc The MMalloc() routine performs minimal mathematical operations to the supplied value before allocating memory. An attacker can specify a malicious number that will result in an integer overflow and cause a small memory chunk to be allocated. The original and larger supplied value will be later used in an inline memcpy(): 00402D6E rep movsd ; destination is attacker allocated 00402D70 mov ecx, edx 00402D72 and ecx, 3 00402D75 rep movsb This instruction sequence will copy attacker-supplied data beyond the brims of the allocated heap chunk and arbitrarily overwrite the heap. Too large a payload will cause an access violation as it writes off the end of the heap. If the supplied data is large enough, it will corrupt the heap and eventually result in a classic arbitrary DWORD overwrite in NTDLL during subsequent heap manipulation: 77FCC2C0 mov [ecx], eax 77FCC2C2 mov [eax+4], ecx By overwriting the address of a soon to be called function, the attacker can redirect CPU flow and eventually execute arbitrary code. III. ANALYSIS Successful exploitation of the described vulnerability allows unauthenticated remote attackers to execute arbitrary code with the privileges of the underlying user, normally NetMailService. IV. DETECTION iDEFENSE has confirmed the existence of the vulnerability in the latest version of Novell NetMail, version 3.5.2. It is suspected that earlier versions of NetMail are also affected. V. WORKAROUND Employ firewalls, access control lists or other TCP/UDP restriction mechanisms to limit access to systems and services. VI. VENDOR RESPONSE The following vendor advisory has been released to address this vulnerability: http://support.novell.com/cgi-bin/search/searchtid.cgi?/10097957.htm VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2005-1758 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 04/25/2005 Initial vendor notification 04/25/2005 Initial vendor response 09/01/2005 Public disclosure IX. CREDIT This vulnerability was discovered by Pedram Amini, OpenRCE (www.openrce.org). Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp Free tools, research and upcoming events http://labs.idefense.com X. LEGAL NOTICES Copyright (c) 2005 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@private for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
This archive was generated by hypermail 2.1.3 : Thu Sep 01 2005 - 11:52:33 PDT