72149 - Sending mail w/o user's consent using form post

Status: VERIFIED DUPLICATE of bug 83401

(Core :: Security, defect)

Description

[Mitchell Stoltz (not reading bugmail)]

Well, I started to think what sort of bugs we could get using techniques
similar to bug 71916 (the gopher security bug). And I came up with the
attached. See the notes at the top. If you don't have sendmail 8.11
installed on your target host then you'll have to use port 25 instead of
587. ns4 doesn't work with port 25, so this exploit won't work under ns4
on that port.

You have to have the enctype set on the form so that the newlines aren't
escaped.

I don't want to put this in bugzilla for obvious reasons.

Blocking all ports < 1024 apart from the defaults is not a solution - I've
seen webservers on 81 occasionally. This can be used to exploit any
protocol which will ignore invalid lines.

I mentioned this to jag, and he suggested a frame with height=1 so that
the user never knows about it.

Bradley

Comment 1

[Mitchell Stoltz (not reading bugmail)]

Attachment: Demonstration of the exploit

Comment 2

[Mitchell Stoltz (not reading bugmail)]

This was contributed by [e-mail], but he wanted it kept confidential
for the time being, which is why I'm filing it.

Comment 3

[ckritzer (gone)]

Okay, I'm using the exmaple, but I'm not sure a) the example is supposed to do 
anything or b) the fix that is in blocks the unwanted behaviour.  Mitch?

Comment 4

[Mitchell Stoltz (not reading bugmail)]

Whoops, this isn't fixed. I'm not sure why this was marked fixed. No wonder I
couldn't find it... dougt filed a bugscape bug on this, but I'll close that one
out in favor of this one, since it belongs in bugzilla. Reopening and
reassigning to gagan, since this is a Necko issue.

Comment 5

[Mitchell Stoltz (not reading bugmail)]

->gagan

Comment 6

[Bradley Baetz (:bbaetz)]

The exploit needs a bit of modifying to work (you have to change the mailserver
from localhost to judge.mcom.com, and set a valid name for the mail receiver).
The bugscape bug is bug 5574.

I wanted it confidential because it was exploitable :)

Comment 7

[Doug Turner (:dougt)]

this is a dup of the more active bug 

*** This bug has been marked as a duplicate of 83401 ***

Comment 8

[ckritzer (gone)]

Marking VERIFIED DUPLICATE.

Comment 9

[Bradley Baetz (:bbaetz)]

-nsconf (after discussion with mitch) so that this can be mentioned in a relnote