CAPEC-42 - MIME Conversion

An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Severity

Likelihood

Confidentiality

Integrity

Availability

  • Attack Methods 1
  • Injection
  • Purposes 2
  • Penetration
  • Exploitation
  • Sec Principles 1
  • Failing Securely
  • Scopes 4
  • Execute unauthorized code or commands
  • Availability
  • Integrity
  • Confidentiality
  • Modify memory
  • Integrity
  • DoS: crash / exit / restart
  • Availability
  • Gain privileges / assume identity
  • Authorization
  • Access_Control
  • Confidentiality

Low level: It may be trivial to cause a DoS via this attack pattern

High level: Causing arbitrary code to execute on the target system.

The target system uses a mail server.

Mail server vendor has not released a patch for the MIME conversion routine, the patch itself has a security hole or does not fix the original problem, or the patch has not been applied to the user's system.

The first step is to figure what mail server (and what version) is running on the target system.

Step 1 -

Determine whether the mail server is unpatched and is potentially vulnerable to one of the known MIME conversion buffer overflows (e.g. Sendmail 8.8.3 and 8.8.4)..

Step 2 -

Identify places in the system where vulnerable MIME conversion routines may be used..


Step 1 -

Send e-mail messages to the target system with specially crafted headers that trigger the buffer overflow and execute the shell code..


Stay up to date with third party vendor patches

Disable the 7 to 8 bit conversion. This can be done by removing the F=9 flag from all Mailer specifications in the sendmail.cf file.
For example, a sendmail.cf file with these changes applied should look similar to (depending on your system and configuration):
This can be achieved for the "Mlocal" and "Mprog" Mailers by modifying the ".mc" file to include the following lines:
and then rebuilding the sendmail.cf file using m4(1).
From "Exploiting Software", please see reference below.

Use the sendmail restricted shell program (smrsh)

Use mail.local