Novell NetMail IMAPD缓冲区溢出漏洞

发布日期：2005-11-18
更新日期：2005-11-18

受影响系统：

Novell NetMail

描述：

---

BUGTRAQ ID: 15491
CVE(CAN) ID: CVE-2005-3314

Novell NetMail是基于Internet标准消息和安全协议的邮件和日历系统。

由于没有正确的过滤用户输入，Novell NetMail的IMAPD中存在缓冲区溢出漏洞，可能允许攻击者远程执行任意代码。

<*来源：zdi-disclosures （zdi-disclosures@3com.com）

链接：http://marc.theaimsgroup.com/?l=full-disclosure&m=113233697018470&w=2
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

--=_alternative 006348FA882570BD_=
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: base64

WkRJLTA1LTAwMyAtIE5vdmVsbCBOZXRNYWlsIElNQVBEIEJ1ZmZlciBPdmVyZmxvd3MNCmh0dHA6
Ly93d3cuemVyb2RheWluaXRpYXRpdmUuY29tL2Fkdmlzb3JpZXMvWkRJLTA1LTAwMy5odG1sDQpO
b3ZlbWJlciAxOHRoLCAyMDA1DQoNCkNWRSBJRDogQ0FOLTIwMDUtMzMxNCANCg0KQWZmZWN0ZWQg
VmVuZG9yOg0KIC0gTm92ZWxsDQoNCkFmZmVjdGVkIFByb2R1Y3RzOg0KIC0gTm92ZWxsIE5ldG1h
aWwgMy41LjIgDQoNClRpcHBpbmdQb2ludFRNIElQUyBDdXN0b21lciBQcm90ZWN0aW9uOg0KVGlw
cGluZ1BvaW50IElQUyBjdXN0b21lcnMgaGF2ZSBiZWVuIHByb3RlY3RlZCBhZ2FpbnN0IHRoaXMg
dnVsbmVyYWJpbGl0eSANCnNpbmNlIE9jdG9iZXIgMjR0aCwgMjAwNSBieSBEaWdpdGFsIFZhY2Np
bmUgcHJvdGVjdGlvbiBmaWx0ZXIgSUQgMzg2OC4gRm9yIA0KZnVydGhlciBwcm9kdWN0IGluZm9y
bWF0aW9uIG9uIHRoZSBUaXBwaW5nUG9pbnQgSVBTOiANCiAgICB3d3cudGlwcGluZ3BvaW50LmNv
bQ0KIA0KVnVsbmVyYWJpbGl0eSBEZXRhaWxzOg0KVGhpcyB2dWxuZXJhYmlsaXR5IGFsbG93cyBy
ZW1vdGUgYXR0YWNrZXJzIHRvIGV4ZWN1dGUgYXJiaXRyYXJ5IGNvZGUgb24gDQp2dWxuZXJhYmxl
IGluc3RhbGxhdGlvbnMgb2YgTm92ZWxsIE5ldG1haWwuIEF1dGhlbnRpY2F0aW9uIGlzIHJlcXVp
cmVkIHRvIA0KZXhwbG9pdCB0aGlzIHZ1bG5lcmFiaWxpdHkuIA0KDQpUaGlzIHNwZWNpZmljIGZs
YXcgZXhpc3RzIHdpdGhpbiB0aGUgSU1BUCBkYWVtb24uIEEgbGFjayBvZiBib3VuZHMgDQpjaGVj
a2luZyBkdXJpbmcgdGhlIHBhcnNpbmcgb2YgbG9uZyB2ZXJiIGFyZ3VtZW50cyByZXN1bHRzIGlu
IGFuIA0KZXhwbG9pdGFibGUgc3RhY2stYmFzZWQgb3ZlcmZsb3cuIA0KDQpWZW5kb3IgUmVzcG9u
c2U6DQoiTm92ZWxsIGhhcyBpc3N1ZWQgYSB1cGRhdGUgZm9yIHRoZSB2dWxuZXJhYmlsaXR5KGll
cykgYW5kIHRoZSB1cGRhdGUgaXMgDQphdmFpbGFibGUgYXQ6IiANCiAgICBzdXBwb3J0Lm5vdmVs
bC5jb20vZmlsZWZpbmRlci8xOTM1Ny9iZXRhLmh0bWwgDQoNCkRpc2Nsb3N1cmUgVGltZWxpbmU6
DQoyMDA1LjEwLjI0IOKAkyBWdWxuZXJhYmlsaXR5IHJlcG9ydGVkIHRvIHZlbmRvcg0KMjAwNS4x
MC4yNCDigJMgRGlnaXRhbCBWYWNjaW5lIHJlbGVhc2VkIHRvIFRpcHBpbmdQb2ludCBjdXN0b21l
cnMNCjIwMDUuMTEuMTcg4oCTIFZ1bG5lcmFiaWxpdHkgaW5mb3JtYXRpb24gcHJvdmlkZWQgdG8g
WkRJIHNlY3VyaXR5IHBhcnRuZXJzDQoyMDA1LjExLjE4IOKAkyBDb29yZGluYXRlZCBwdWJsaWMg
cmVsZWFzZSBvZiBhZHZpc29yeQ0KDQpDcmVkaXQ6DQpUaGlzIHZ1bG5lcmFiaWxpdHkgd2FzIGRp
c2NvdmVyZWQgYnkgU2ViYXN0aWFuIEFwZWx0LiANCg0KQWJvdXQgdGhlIFplcm8gRGF5IEluaXRp
YXRpdmUgKFpESSk6DQpFc3RhYmxpc2hlZCBieSBUaXBwaW5nUG9pbnQsIGEgZGl2aXNpb24gb2Yg
M0NvbSwgVGhlIFplcm8gRGF5IEluaXRpYXRpdmUgDQooWkRJKSByZXByZXNlbnRzIGEgYmVzdC1v
Zi1icmVlZCBtb2RlbCBmb3IgcmV3YXJkaW5nIHNlY3VyaXR5IHJlc2VhcmNoZXJzIA0KZm9yIHJl
c3BvbnNpYmx5IGRpc2Nsb3NpbmcgZGlzY292ZXJlZCB2dWxuZXJhYmlsaXRpZXMuIA0KDQpSZXNl
YXJjaGVycyBpbnRlcmVzdGVkIGluIGdldHRpbmcgcGFpZCBmb3IgdGhlaXIgc2VjdXJpdHkgcmVz
ZWFyY2ggdGhyb3VnaCANCnRoZSBaREkgY2FuIGZpbmQgbW9yZSBpbmZvcm1hdGlvbiBhbmQgc2ln
bi11cCBhdDogDQogICAgd3d3Lnplcm9kYXlpbml0aWF0aXZlLmNvbSANCg0KVGhlIFpESSBpcyB1
bmlxdWUgaW4gaG93IHRoZSBhY3F1aXJlZCB2dWxuZXJhYmlsaXR5IGluZm9ybWF0aW9uIGlzIHVz
ZWQuIA0KM0NvbSBkb2VzIG5vdCByZS1zZWxsIHRoZSB2dWxuZXJhYmlsaXR5IGRldGFpbHMgb3Ig
YW55IGV4cGxvaXQgY29kZS4gDQpJbnN0ZWFkLCB1cG9uIG5vdGlmeWluZyB0aGUgYWZmZWN0ZWQg
cHJvZHVjdCB2ZW5kb3IsIDNDb20gcHJvdmlkZXMgaXRzIA0KY3VzdG9tZXJzIHdpdGggemVybyBk
YXkgcHJvdGVjdGlvbiB0aHJvdWdoIGl0cyBpbnRydXNpb24gcHJldmVudGlvbiANCnRlY2hub2xv
Z3kuIEV4cGxpY2l0IGRldGFpbHMgcmVnYXJkaW5nIHRoZSBzcGVjaWZpY3Mgb2YgdGhlIHZ1bG5l
cmFiaWxpdHkgDQphcmUgbm90IGV4cG9zZWQgdG8gYW55IHBhcnRpZXMgdW50aWwgYW4gb2ZmaWNp
YWwgdmVuZG9yIHBhdGNoIGlzIHB1YmxpY2x5IA0KYXZhaWxhYmxlLiBGdXJ0aGVybW9yZSwgd2l0
aCB0aGUgYWx0cnVpc3RpYyBhaW0gb2YgaGVscGluZyB0byBzZWN1cmUgYSANCmJyb2FkZXIgdXNl
ciBiYXNlLCAzQ29tIHByb3ZpZGVzIHRoaXMgdnVsbmVyYWJpbGl0eSBpbmZvcm1hdGlvbiANCmNv
bmZpZGVudGlhbGx5IHRvIHNlY3VyaXR5IHZlbmRvcnMgKGluY2x1ZGluZyBjb21wZXRpdG9ycykg
d2hvIGhhdmUgYSANCnZ1bG5lcmFiaWxpdHkgcHJvdGVjdGlvbiBvciBtaXRpZ2F0aW9uIHByb2R1
Y3QuIA0K
--=_alternative 006348FA882570BD_=
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: base64

DQo8YnI PGZvbnQgc2l6ZT0yIGZhY2U9InNhbnMtc2VyaWYiPlpESS0wNS0wMDMgLSBOb3ZlbGwg
TmV0TWFpbCBJTUFQRCBCdWZmZXINCk92ZXJmbG93czwvZm9udD4NCjxicj48Zm9udCBzaXplPTIg
ZmFjZT0ic2Fucy1zZXJpZiI aHR0cDovL3d3dy56ZXJvZGF5aW5pdGlhdGl2ZS5jb20vYWR2aXNv

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有