Vulnerabilities > CVE-2009-2356 - Buffer Errors vulnerability in DAN Cahill Nulllogic Groupware 1.2.7
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Multiple stack-based buffer overflows in the pgsqlQuery function in NullLogic Groupware 1.2.7, when PostgreSQL is used, might allow remote attackers to execute arbitrary code via input to the (1) POP3, (2) SMTP, or (3) web component that triggers a long SQL query.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Seebug
| bulletinFamily | exploit |
| description | CVE(CAN) ID: CVE-2009-2354,CVE-2009-2355,CVE-2009-2356 Groupware是一个开源的团队协作软件，包含有即时消息、公共论坛、邮件等多种功能。 远程攻击者可以通过向Groupware的多个模块提交恶意参数请求导致拒绝服务或执行任意代码。 1) Groupware在与数据库服务器通讯时通常会调用sql_queryf函数，该函数会使用C格式字符串和其他参数来创建SQL查询。例如，在试图登录的时候，auth_checkpass函数会生成以下查询： if ((sqr=sql_queryf(sid, "SELECT userid, password FROM gw_users WHERE username = '%s' and enabled > 0", sid->dat->user_username))<0) { 由于可以从请求的用户名参数控制sid->dat->user_username的值，因此可以通过SQL注入的方式控制数据库所执行的SQL查询。 2) Groupware的论坛模块使用用户传送的参数来选择用户所要访问的论坛。由于没有正确地验证这个输入参数，如果远程攻击者向fmessagelist函数传送了空的或非数字的字符串，就会导致崩溃。 3) 当Groupware配置为使用PostgreSQL数据库服务器时会调用以下函数： int pgsqlQuery(CONN *sid, int sqr, char *sqlquery) { ... char query[8192]; ... memset(query, 0, sizeof(query)); snprintf(query, sizeof(query)-1, "DECLARE myportal CURSOR FOR "); strncat(query, sqlquery, sizeof(query)); ... } 该函数在栈上为查询分配了8192字节的缓冲区，然后继续创建SQL查询，但在创建28字节固定长度的字符串时最多又连接了8192字节的数据，因此写到栈上的全部数据（8220字节）大于最初所分配的缓冲区。理论上只要所传送的sqlquery值大于8163字节，就可以溢出函数基指针（%ebp）和返回地址（%eip）。 NullLogic Groupware 1.2.7 厂商补丁： NullLogic --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://nullwebmail.sourceforge.net/groupware/ |
| id | SSV:11785 |
| last seen | 2017-11-19 |
| modified | 2009-07-10 |
| published | 2009-07-10 |
| reporter | Root |
| title | NullLogic Groupware多个远程安全漏洞 |