Ipswitch IMail Server/协作组件IMAP FETCH命令远程溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1196700 漏洞类型 缓冲区溢出
发布时间 2006-03-10 更新时间 2007-02-20
CVE编号 CVE-2005-3526 CNNVD-ID CNNVD-200512-666
漏洞平台 N/A CVSS评分 6.5
|漏洞来源
https://www.securityfocus.com/bid/17063
https://cxsecurity.com/issue/WLB-2006030069
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200512-666
|漏洞详情
IpswitchIMailServer是美国Ipswitch公司的一款运行于MicrosoftWindows操作系统中的邮件服务器。IMailServer的IMAP守护程序在处理用户畸形请求时存在溢出漏洞,远程攻击者可能利用此漏洞在服务器上执行任意指令。在解析FETCH命令的超长参数时缺少边界检查,导致攻击者可以远程执行任意指令。
|漏洞EXP
ZDI-06-003: Ipswitch Collaboration Suite Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-06-003.html
March 13, 2006

-- CVE ID:
CVE-2005-3526

-- Affected Vendor:
Ipswitch

-- Affected Products:
Ipswitch Collaboration Suite 2006.02 and below

-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability since December 13, 2005 by Digital Vaccine protection
filter ID 3982. For further product information on the TippingPoint IPS:

http://www.tippingpoint.com

-- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Ipswitch Collaboration Suite.
Authentication is required to exploit this vulnerability.

This specific flaw exists within the IMAP daemon. A lack of bounds
checking during the parsing of long arguments to the FETCH verb can
result in an exploitable buffer overflow.

-- Vendor Response:
From http://www.ipswitch.com/support/ics/updates/ics200603prem.asp:

"IMAP: Corrected a vulnerability issue where a properly crafted Fetch
command causes IMAP to crash with a buffer overflow (disclosed by
TippingPoint, a division of 3Com)."

-- Disclosure Timeline:
2005.12.13 - Vulnerability reported to vendor
2005.12.13 - Digital Vaccine released to TippingPoint customers
2006.03.13 - Public release of advisory

-- Credit:
This vulnerability was discovered by Manuel Santamarina Suarez aka 
'FistFuXXer'.

-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, a division of 3Com, The Zero Day Initiative
(ZDI) represents a best-of-breed model for rewarding security
researchers for responsibly disclosing discovered vulnerabilities.

Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:

http://www.zerodayinitiative.com

The ZDI is unique in how the acquired vulnerability information is used.
3Com does not re-sell the vulnerability details or any exploit code.
Instead, upon notifying the affected product vendor, 3Com provides its
customers with zero day protection through its intrusion prevention
technology. Explicit details regarding the specifics of the
vulnerability are not exposed to any parties until an official vendor
patch is publicly available. Furthermore, with the altruistic aim of
helping to secure a broader user base, 3Com provides this vulnerability
information confidentially to security vendors (including competitors)
who have a vulnerability protection or mitigation product.
|受影响的产品
Ipswitch Ipswitch Collaboration Suite Standard Edition 2006 Ipswitch Ipswitch Collaboration Suite Premium Edition 2006 Ipswitch IMail Server 2006 Ipswitch IMail Secure Server 2006
|参考资料

来源:XF
名称:ipswitch-imap-fetch-bo(25133)
链接:http://xforce.iss.net/xforce/xfdb/25133
来源:VUPEN
名称:ADV-2006-0907
链接:http://www.frsirt.com/english/advisories/2006/0907
来源:SECUNIA
名称:19168
链接:http://secunia.com/advisories/19168
来源:MISC
链接:http://www.zerodayinitiative.com/advisories/ZDI-06-003.html
来源:BID
名称:17063
链接:http://www.securityfocus.com/bid/17063
来源:BUGTRAQ
名称:20060313ZDI-06-003:IpswitchCollaborationSuiteCodeExecutionVulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/427536/100/0/threaded
来源:OSVDB
名称:23796
链接:http://www.osvdb.org/23796
来源:www.ipswitch.com
链接:http://www.ipswitch.com/support/ics/updates/ics200603prem.asp
来源:SECTRACK
名称:1015759
链接:http://securitytracker.com/id?1015759
来源:SREASON
名称:577
链接:http://securityreason.com/securityalert/577
来源:NSFOCUS
名称:8565
链接:http://www.nsfocus.net/vulndb/8565