# Novell NetMail IMAPD Command Continuation Request Heap Overflow
DESCRIPTION
Remote exploitation of a heap overflow vulnerability in Novell Inc.'s
NetMail IMAP daemon allows unauthenticated attackers to execute
arbitrary code with the privileges of the underlying user.
The problem specifically exists in the handling of command continuation
requests as the user-specified size value is used directly as the
argument to a custom memory allocation wrapper (MMalloc()):
; ebx is attacker controlled
00402CA2 lea ecx, [ebx+1]
00402CA5 push ecx
00402CA6 call MMmalloc
The MMalloc() routine performs minimal mathematical operations to the
supplied value before allocating memory. An attacker can specify a
malicious number that will result in an integer overflow and cause a
small memory chunk to be allocated. The original and larger supplied
value will be later used in an inline memcpy():
; destination is attacker allocated
00402D6E rep movsd
00402D70 mov ecx, edx
00402D72 and ecx, 3
00402D75 rep movsb
This instruction sequence will copy attacker-supplied data beyond the
brims of the allocated heap chunk and arbitrarily overwrite the heap.
Too large a payload will cause an access violation as it writes off the
end of the heap. If the supplied data is large enough, it will corrupt
the heap and eventually result in a classic arbitrary DWORD overwrite
in NTDLL during subsequent heap manipulation:
77FCC2C0 mov [ecx], eax
77FCC2C2 mov [eax+4], ecx
By overwriting the address of a soon to be called function, the attacker
can redirect CPU flow and eventually execute arbitrary code.
ANALYSIS
Successful exploitation of the described vulnerability allows
unauthenticated remote attackers to execute arbitrary code with the
privileges of the underlying user, normally NetMailService.