Multiple Buffer Overflows in SLMail
May 7th, 2003NGSSoftware Insight Security Research Advisory
Name: Multiple Buffer Overflows in SLMail
Systems Affected: SLMail 5.1.0.4420 on Windows
Severity: High Risk
Vendor URL: http://www.slmail.com
Authors: David Litchfield (david@ngssoftware.com)
Mark Litchfield (mark@ngssoftware.com)
Date: 7th May 2003
Advisory URL: http://www.nextgenss.com/advisories/slmail-vulns.txt
Advisory number: #NISR07072003A
Description
***********
SLMail is described by the vendor as a “security conscious Windows NT / 2000 email server”. The SMTP engine, poppasswd and pop3 server of SLMail suffer from multiple remotely exploitable buffer overflow vulnerabilities.
Details
*******
SMTP Engine Buffer Overflows
By supplying an overly long parameter to the ETRN command the saved return address on the stack is overwritten due classic stack based overflow vulnerability. This is due to an unsafe call to the lstrcat() function. This can only be exploited by first greeting the server using EHLO, however, as opposed to the older HELO.
Whilst the process that listens on TCP port 25 (the SMTP port) is slsmtp.exe - the vulnerable process is slmail.exe. slsmtp.exe simply passes any input to slmail.exe for processing.
On overflowing the buffer, overwriting the saved return address with an address that contains a “jmp esp” instruction it is possible to divert the flow of execution into the user supplied buffer and thus execute arbitrary code. By default SLMail runs as a service in the security context of the SYSTEM account. As such complete control over the operating system can be gained.
The XTRN command is also known to be vulnerable.
POPPASSWD Buffer Overflow
By connecting to TCP port 106 and supplying an overly string a saved return address is overwritten on the stack. Again this is exploitable.
POP3 Server Buffer Overflow
By supplying an overly long password when attempting authentication a saved return address is overwritten on the stack.
Fix Information
***************
NGSSoftware alerted SLMail to most of these issues in early Februray and an upgrade has been released. See http://www.slmail.com for more details.
If upgrading is not an option then NGSSoftware recommends that step be taken to mitigate the risk by only allowing access to the POPPASSWD and POP3 server from “inside” the firewall. “External” access can be provided allowing clients to connect via an authenticated VPN to the DMZ and then to the POP services from there.
By disabling ESMTP and allowing only SMTP one can protect against the SMTP attacks. ESMTP can be turned off using the SLMail Configuration Utility.
The SLMail server does not require SYSTEM or administrator privileges to run. To minimize the risk of exploitation of these vulnerabilities it is suggested than a low privileged account is created to be used to run the services. Once an account has been created it must given the correct NTFS and registry permissions – otherwise the server will fail to start correctly.
To create an account open a command prompt and issue a command such as the following, though choosing a different password:
C:\>net user slmail 5T@r*m4N!nsKy~ /add
Then add this account to the local “guests” group:
C:\>net localgroup guests slmail /add
And finally remove it from the “users” group:
C:\> net localgroup users slmail /del
Once created and the appropriate groups have been assigned/removed, open the Registry Editor (Regedt32) and navigate to and highlight
“HKEY_LOCAL_MACHINE\Software\Seattle Lab”
On the “Menu” bar select “Security” then “Permissions” then add the “slmail” user assigning it “full control” to this key and all subkeys. Once done close the Registry Editor.
Then through Windows Explorer, navigate to the SLMail install directory. This is typically
C:\Program files\SLMail
Right Click on this directory, select “Properties” and then the “Security” Tab. Add the “slmail” user assigning the account “full control” to this directory, its subdirectories and files.
Lastly open the Control Panel/Administrative Tools and select “Services”. Find the entries for “Seattle Lab POP3 Server” and “Seattle Lab SMTP Server”. Set these services to log on using the “slmail” account. Stop and restart the services for the changes to take effect.
A check for these issues has been added to Typhon, a comprehensive automated vulnerability assessment tool of which more information is available from the NGSSite: http://www.ngssoftware.com/
About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware have
offices in the South of London and the East Coast of Scotland. NGSSoftware’s
sister company NGSConsulting, offers best of breed security consulting
services, specialising in application, host and network security
assessments.
http://www.ngssoftware.com/
http://www.ngsconsulting.com/
Telephone +44 208 401 0070
Fax +44 208 401 0076
enquiries@ngssoftware.com
