YahooPOPS! Multiple Remote Buffer Overflow Vulnerabilities
BID:11256
Info
YahooPOPS! Multiple Remote Buffer Overflow Vulnerabilities
| Bugtraq ID: | 11256 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 27 2004 12:00AM |
| Updated: | Feb 07 2006 08:54PM |
| Credit: | Nima Majidi <[email protected]> discovered these vulnerabilities. |
| Vulnerable: |
YahooPOPS! YahooPOPS! 0.6 YahooPOPS! YahooPOPS! 0.5 YahooPOPS! YahooPOPS! 0.4 |
| Not Vulnerable: |
YahooPOPS! YahooPOPS! 0.6 .050104 |
Discussion
YahooPOPS! Multiple Remote Buffer Overflow Vulnerabilities
YahooPOPS! is reported to contain multiple buffer-overflow vulnerabilities. These vulnerabilities are due to application's failure to properly bounds-check user-supplied input data before copying it into finite-sized memory buffers. This allows attackers to overwrite adjacent memory, potentially overwriting critical memory structures and altering the flow of execution. This will likely allow for remote code execution in the context of the affected application.
Versions of YahooPOPS! from 0.4 through 0.6 are reportedly affected by these vulnerabilities.
YahooPOPS! is reported to contain multiple buffer-overflow vulnerabilities. These vulnerabilities are due to application's failure to properly bounds-check user-supplied input data before copying it into finite-sized memory buffers. This allows attackers to overwrite adjacent memory, potentially overwriting critical memory structures and altering the flow of execution. This will likely allow for remote code execution in the context of the affected application.
Versions of YahooPOPS! from 0.4 through 0.6 are reportedly affected by these vulnerabilities.
Exploit / POC
YahooPOPS! Multiple Remote Buffer Overflow Vulnerabilities
A proof of concept exploit was provided. Examples sufficient to demonstrate the vulnerability have also been provided:
For the POP3 service:
Telnet localhost 110
+OK POP3 YahooPOPs! Proxy ready
[USER][180xA][BBBB]
For the SMTP service:
Telnet localhost 25
220 YahooPOPs! Simple Mail Transfer Service Ready
[504xA] [BBBB]
Nima Majidi <[email protected]>, "class 101" <[email protected]>, Diabolic Crab <[email protected]>, and varun uppal <[email protected]> have all provided exploit examples.
y0 <[email protected]> has created an exploit for the Metasploit framework (ypops_smtp.pm):
http://downloads.securityfocus.com/vulnerabilities/exploits/ypops_smtp.pm
A proof of concept exploit was provided. Examples sufficient to demonstrate the vulnerability have also been provided:
For the POP3 service:
Telnet localhost 110
+OK POP3 YahooPOPs! Proxy ready
[USER][180xA][BBBB]
For the SMTP service:
Telnet localhost 25
220 YahooPOPs! Simple Mail Transfer Service Ready
[504xA] [BBBB]
Nima Majidi <[email protected]>, "class 101" <[email protected]>, Diabolic Crab <[email protected]>, and varun uppal <[email protected]> have all provided exploit examples.
y0 <[email protected]> has created an exploit for the Metasploit framework (ypops_smtp.pm):
http://downloads.securityfocus.com/vulnerabilities/exploits/ypops_smtp.pm
Solution / Fix
YahooPOPS! Multiple Remote Buffer Overflow Vulnerabilities
Solution:
These issues have been addressed in version 0.6.050104.
YahooPOPS! YahooPOPS! 0.4
YahooPOPS! YahooPOPS! 0.5
YahooPOPS! YahooPOPS! 0.6
Solution:
These issues have been addressed in version 0.6.050104.
YahooPOPS! YahooPOPS! 0.4
-
YahooPOPS! yahoopops_0_6_050104.zip
http://home.comcast.net/~dbeusee/yahoopops_0_6_050104.zip
YahooPOPS! YahooPOPS! 0.5
-
YahooPOPS! yahoopops_0_6_050104.zip
http://home.comcast.net/~dbeusee/yahoopops_0_6_050104.zip
YahooPOPS! YahooPOPS! 0.6
-
YahooPOPS! yahoopops_0_6_050104.zip
http://home.comcast.net/~dbeusee/yahoopops_0_6_050104.zip
References
YahooPOPS! Multiple Remote Buffer Overflow Vulnerabilities
References:
References:
- YahooPOPS! Home Page (YahooPOPS!)
- [Hat-Squad] Remote Buffer overflow Vulnerability in YahooPOPS (Hat-Squad Security Team