bugtraq - Remote Execution of Commands in Omail Webmail 0.98.4 and earlier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: 19 Aug 2003 19:15:32 -0000
From: Phillip Whelan <pwhelan@...kerchile.net>
To: bugtraq@...urityfocus.com
Subject: Remote Execution of Commands in Omail Webmail 0.98.4 and earlier




Product: Omail Webmail
Author:  Olivier Mueller
Vulnerable Versions: 
	- 0.98.x
	- 0.97.x
	- ...


    Omail is a Webmail coded in perl for qmail,
optionally with vmailmgr
or vpopmail.

   There is a security flaw in Omail which, if
installed by default, allows 
for remote root access. The minimum risk is exposure of
sensitive information
(all email accessible to omail), as well as remote
execution of commands as
a non-privileged user.

The flaw occurs in the function checklogin();

.........

omail.pl, line 689:

    my $command = 'echo -e "'. $domainname .'\000'. 
$username .'\000'.$password .'\000" | ' .$vauthenticate;
    my $output = `$command`;

.........


Prior to calling this line, the variables
$domainname,$username, and
$password are not filtered for shell metacharacters,
which results in the 
possibility of the execution of arbritrary commands.


The patch in itself is quite simple:


--- omail-webmail-0.98.4/omail-old.pl   2001-08-26
08:35:27.000000000 -0400
+++ omail-webmail-0.98.4/omail.pl       2003-07-28
12:29:36.000000000 -0400
@@ -396,7 +396,7 @@

   if (($vmailmgr || $vpopmail) && $cgi_mode eq "suid") {

-    if (!($userid =~ /(.*)\@(.*)/)) {
+    if (!($userid =~ /([A-Z,a-z,0-9]*)\@([\w\.]*)$/)) {
       omailerror("domain name is missing : format
userid\@domain");
     } else {
       $userid = $1;
@@ -406,7 +406,7 @@


   my $password = param("password");
-  $password =~ /^(.+)$/;
+  $password =~ /^([^\"]+)$/;
   $password = $1;

   # 8 possible cases :



The author was contacted two weeks ago, but did not
respond.

----------------------------------------------------
Phillip Whelan - Security Consultant
BunkerChile S.A. - Network Security Consulting Group
homepage: http://www.bunkerchile.net
email: info@...kerchile.net
----------------------------------------------------