####################################################################### Luigi Auriemma Application: Novell GroupWise Messenger http://www.novell.com/products/groupwise/ Versions: <= 2.1.0 Platforms: Windows, Linux, NetWare Bug: memory corruption Exploitation: remote, versus server Date: 16 Feb 2012 (found 10 May 2011) Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Check vendor's homepage and version because this is an old advisory. ####################################################################### ====== 2) Bug ====== nmma.exe is a service running on port 8300. The NM_A_PARM1 tag of the "login" command is the base64 of the "username::password" string encrypted with blowfish. This tag has the value 10 which is relative to the strings, but exists another type defined as 12 which instead is used for particular data ("nested arrays") and when used for login->NM_A_PARM1 allows to corrupt the heap memory: 0042BCD9 |. 8B0B MOV ECX,DWORD PTR DS:[EBX] ; 3 0042BCDB |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4] ; 3 0042BCDE |. C1EE 02 SHR ESI,2 0042BCE1 |. 81C6 55555555 ADD ESI,55555555 0042BCE7 |. 8D0476 LEA EAX,DWORD PTR DS:[ESI+ESI*2] 0042BCEA |. 50 PUSH EAX ; 0xffffffff 0042BCEB |. 51 PUSH ECX ; heap 0042BCEC |. 52 PUSH EDX ; context 0042BCED |. E8 5E0E0000 CALL nmma.0042CB50 ; blowfish Through additional packets before and after the malformed one (the service is multi-thread) may be possible to control the corruption. ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/nmma_x.zip http://www.exploit-db.com/sploits/nmma_x.zip nmma_x 1 SERVER ####################################################################### ====== 4) Fix ====== No fix. #######################################################################