[UNIX] XMail 'sendmail' Recipient Local Buffer Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

XMail 'sendmail' Recipient Local Buffer Overflow
------------------------------------------------------------------------

SUMMARY

" <http://www.xmailserver.org/> XMail is an Internet and Intranet mail
server featuring an SMTP server, POP3 server, finger server and multiple
domains."

Local exploitation of a buffer overflow vulnerability in XMail, as
distributed with multiple vendors' operating systems, allows local
attackers to execute arbitrary code with elevated privileges.

DETAILS

Vulnerable Systems:
* XMail version 1.21

Immune Systems:
* XMail version 1.22

The vulnerability exists because of insufficient bounds checking on
user-supplied data. Specifically, the AddressFromAtPtr function fails to
check bounds on arguments passed from other functions, and as a result an
exploitable stack overflow condition occurs when specifying the "-t"
command line option. The "-t" command line option allows users to specify
the recipient value in the text of the message on a line beginning with
"To:". XMail passes the user-supplied value without bounds checking to
AdressFromAtPtr and attempts to store the hostname portion of the e-mail
address in a 256-byte buffer. Crafted e-mail addresses can overflow the
buffer and overwrite stack process control data, resulting in local code
execution with elevated privileges.

Successful exploitation will result in code execution with elevated
privileges. XMail is distributed in RPM, DEB and source format. The RPM
distribution installs the sendmail binary with setuid root privileges.

Exploitation of XMail installed from RPM will yield root. Other
distribution formats install the sendmail binary as setgid mail.

Exploitation resulting in group mail privileges will allow an attacker to
read all unencrypted mail stored locally in the system mail folders.

Vendor Status:
The vendor has released XMail 1.22 to address this issue which is
available for download at: <http://www.xmailserver.org/>
http://www.xmailserver.org/

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2943>
CAN-2005-2943

Disclosure Timeline:
10/12/2005 - Initial vendor notification
10/12/2005 - Initial vendor response
10/13/2005 - Coordinated public disclosure

ADDITIONAL INFORMATION

The information has been provided by <mailto:labs-no-reply@idefense.com>
iDEFENSE Labs.
The original article can be found at:
<http://www.idefense.com/application/poi/display?id=321&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=321&type=vulnerabilities

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.