Bugtraq: [SNS Advisory No.55 rev.2] Eudora 5.x for Windows Buffer Overflow Vulnerability

[Atsushi Nishimura <a.nisimr () lac co jp>]

----------------------------------------------------------------------
SNS Advisory No.55
Eudora 5.x for Windows Buffer Overflow Vulnerability rev.2

Problem first discovered: 6 Jun 2002
Published: 5 Aug 2002
Last revised: 8 Aug 2002
----------------------------------------------------------------------

Overview:
---------
  Eudora 5.x for Windows contains a buffer overflow vulnerability, 
  which could allow a remote attacker to execute arbitrary code.

Problem Description:
--------------------
  Eudora developed and distributed by QUALCOMM Inc. 
  (http://www.qualcomm.com/), is a Mail User Agent running on Windows 
  95/98/2000/ME/NT 4.0 and MacOS 8.1 or later.

  The buffer overflow occurs when Eudora receives a message using 139 bytes
  or more of string as a boundary, which is used to divide a multi-part
  message into separate parts. In our verification environment, we have
  found that this could allow arbitrary commands to be executed. 

Tested Version:
---------------
  Eudora 5.0-J for Windows (Ver.5.0.2-Jr2 trial) [Japanese]
  Eudora 5.1.1 for Windows (Sponsored Mode) [English]

Tested OS:
----------
  Microsoft Windows 2000 Professional SP2 [Japanese]
  Microsoft Windows 98 SE [Japanese]

Solution:
---------
  You can limit your exposure to this problem by using a content filtering
  software which screen out email messages using 139 bytes or more of
  string as a boundary.

  QUALCOMM Inc. reported that this problem will be fixed in the next
  release [English].
  
  Livin' on the EDGE Co., Ltd. eported that this problem will be fixed in
  Eudora5.1-J for Windows [Japanese] of the next release.

Communication background:
-------------------------
 6 Jun 2002  : We discovered the vulnerability.
 6 Jun 2002  : We reported the findings to win-eudora-bugs () kuni co jp 
 14 Jun 2002 : the findings were reported again to
               win-eudora-bugs () kuni co jp
 17 Jun 2002 : We contacted QUALCOMM Inc. .
 18 Jun 2002 : QUALCOMM Inc. sent a reply stating that they had started an
               investigation of the problem.
 3 Jul 2002  : We asked QUALCOMM Inc. about the progress of the
               investigation
 19 Jul 2002 : We asked QUALCOMM Inc. again about the progress of the
               investigation
 24 Jul 2002 : We informed QUALCOMM Inc. about the announcement schedule
               of this advisory
 25 Jul 2002 : QUALCOMM Inc. reported that this problem will be fixed in
               the next release
 5 Aug 2002  : We decided to disclose this vulnerability due to concern
               over the potential consequences this issue may cause.
               win-eudora-bugs () kuni co jp has not provided any comments
               on this issue as of August 5, 2002.
 6 Aug 2002  : It turns out that connection has not reached Livin' on the
               EDGE Co., Ltd. (user support of Japanese version).  Livin'
               on the EDGE Co., Ltd. reported that this problem will be
               fixed in the next release immediately.

Discovered by:
--------------
  Nobuo Miwa (LAC / n-miwa () lac co jp)

Revision History:
-----------------
 5 Aug 2002  : * Initial release
 8 Aug 2002  : * Added the detail of problem description
               * Changed "Livin' on the EDGE Co., Ltd." into 
                 "win-eudora-bugs () kuni co jp"
               * Added mitigation strategy to Solution
               * Added the information from Livin' on the EDGE Co., Ltd. to
                 Solution
               * Added the report from Livin' on the EDGE Co., Ltd. to
                 Communication background

Disclaimer:
-----------
  All information in these advisories are subject to change without any 
  advanced notices neither mutual consensus, and each of them is released 
  as it is. LAC Co.,Ltd. is not responsible for any risks of occurrences 
  caused by applying those information.

------------------------------------------------------------------
SecureNet Service(SNS) Security Advisory <snsadv () lac co jp>
Computer Security Laboratory, LAC  http://www.lac.co.jp/security/