eXtremail-v9

[mu-b <mu-b () digit-labs org>]

The attached POC exploits a trivial stack smash in the DNS parsing code
of eXtremail versions <= 2.1.1 (current). The POC attached is rather
trivial in that it simply answers queries with a suitable response
(to exhibit the overflow).

However, the problem is further compounded by the fact that eXtremail
neglects to even verify the validity of the transaction id in any
responses, and thus is trivially vulnerable to DNS spoofing attacks
(I am *pretty* sure a more *inventive* method of exploitation exists
to yield trivial remote root...).

Program received signal SIGSEGV, Segmentation fault.
0xdeadbeef in ?? ()
(gdb) bt
#0  0xdeadbeef in ?? ()
#1  0x3031002e in ?? ()
#2  0x00003634 in ?? ()
#3  0x00000000 in ?? ()
(gdb)

POC: http://www.digit-labs.org/files/exploits/extremail-v9.c
-- 
mu-b
(mu-b () digit-labs org)

  "Only a few people will follow the proof. Whoever does will
     spend the rest of his life convincing people it is correct."
        - Anonymous, "P ?= NP"

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/