CVE-2009-3837
Eureka Email 2.2q - Remote Code Execution via Long POP3 Error Message
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2009-3837.
PoCs published by Metasploit, Dr_IDE & dookie, Francis Provencher, including Metasploit module exploits/windows/misc/eureka_mail_err.
AI-analyzed exploit summary This exploit targets a buffer overflow in Eureka Email 2.2q via an overly long ERR message in a POP3 response. It leverages a JMP ESP instruction in user32.dll to execute arbitrary shellcode, with payload constraints including bad characters and stack adjustments.
Description
Stack-based buffer overflow in Eureka Email 2.2q allows remote POP3 servers to execute arbitrary code via a long error message.
Exploits (4)
This exploit targets a buffer overflow in Eureka Email 2.2q via an overly long ERR message in a POP3 response. It leverages a JMP ESP instruction in user32.dll to execute arbitrary shellcode, with payload constraints including bad characters and stack adjustments.
This exploit targets a buffer overflow in Eureka Mail Client by setting up a fake SMTP server on port 110. It uses an egghunter and a bind shell payload to achieve remote code execution on Windows XP SP3.
This exploit targets a buffer overflow vulnerability in Eureka Mail 2.2q via a crafted payload sent to port 110. It overwrites EIP with a return address pointing to a JMP ESP instruction in kernel32.dll, followed by shellcode to execute cmd.exe.
This Metasploit module exploits a buffer overflow in Eureka Email 2.2q via an excessively long ERR message, targeting the POP3 protocol. It leverages a stack-based overflow to achieve remote code execution by overwriting the return address with a JMP ESP instruction.