Multiple Vendor CDE dtmail/mailtool Buffer Overflow Vulnerability
BID:832
Info
Multiple Vendor CDE dtmail/mailtool Buffer Overflow Vulnerability
| Bugtraq ID: | 832 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-1999-0840 CVE-1999-0841 |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 30 1999 12:00AM |
| Updated: | Jul 11 2009 12:56AM |
| Credit: | First posted to BugTraq by UNYUN <[email protected]> on November 30, 1999. |
| Vulnerable: |
Sun Solaris 7.0 |
| Not Vulnerable: | |
Discussion
Multiple Vendor CDE dtmail/mailtool Buffer Overflow Vulnerability
There are three buffer overflow vulnerabilities in the CDE mail utilities, all of which are installed sgid mail by default.
The first is exploited through overrunning a buffer in the Content-Type: field, which would look something like this:
Content-Type: image/aaaaaaaa long 'a' aaaaaa; name="test.gif"
mailtool will overflow when email is selected which has a content-type field like that. It may be possible for an attacker to obtain root priviliges if shellcode is written appropriately and root selects the malicious email message.
The second vulnerability is in dtmail, which will crash (and possibly execute arbitrary code) if a long paramater is passed argumenting the -f command-line option.
The third is in mailpr, which is vulnerable to a long -f paramater as well.
The most basic consequence of these being exploited is a compromise of local email, since all mail data is set mode 660, read and write permissions granted for members of group mail.
As of November 30, 1999, Solaris 7 is the only known vulnerable platform.
There are three buffer overflow vulnerabilities in the CDE mail utilities, all of which are installed sgid mail by default.
The first is exploited through overrunning a buffer in the Content-Type: field, which would look something like this:
Content-Type: image/aaaaaaaa long 'a' aaaaaa; name="test.gif"
mailtool will overflow when email is selected which has a content-type field like that. It may be possible for an attacker to obtain root priviliges if shellcode is written appropriately and root selects the malicious email message.
The second vulnerability is in dtmail, which will crash (and possibly execute arbitrary code) if a long paramater is passed argumenting the -f command-line option.
The third is in mailpr, which is vulnerable to a long -f paramater as well.
The most basic consequence of these being exploited is a compromise of local email, since all mail data is set mode 660, read and write permissions granted for members of group mail.
As of November 30, 1999, Solaris 7 is the only known vulnerable platform.
Exploit / POC
Multiple Vendor CDE dtmail/mailtool Buffer Overflow Vulnerability
Exploit available:
Exploit available:
References
Multiple Vendor CDE dtmail/mailtool Buffer Overflow Vulnerability
References:
References: