bugtraq - FTGate Pro Server - Multiple Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 10 Sep 2003 00:09:24 -0700 (PDT)
From: Phuong Nguyen <dphuong@...oo.com>
To: bugtraq@...urityfocus.com
Subject: FTGate Pro Server - Multiple Vulnerabilities

Release Date: 09/01/2003

TITLE
=====
FTGate Pro - Multiple Vulnerabilities

DESCRIPTION
============
�FTGate is a professional, award winning family of
mail server applications that offer you exceptional
performance, comprehensive features, ease of use and
advanced security features in a cost effective
package.�

More information at http://www.floosietek.com

PROBLEMS
=========
Version  : FTGate Pro 1.2, build 1331 (latest build)
Tested Platform : Windows 2000, Windows XP
Professional

Multiple vulnerabilities have been found in FTGate Pro
WebAdmin interface (not enable to the Internet by
default) which allows the attackers to learn various
information about the FTGate server and exporting
FTGate sever's mailboxes to a text file (that
including administrator�s password, usernames�
passwords) which would lead the server to a total
compromised. 

DETAILS
=======
[Vulnerability #1] Information Disclosure

The script
http://www.victim.com:8089/tools/ftgatedump.fts will
dumb the FTGate  configuration into a file for you to
send to FTGate support team when you encountered a
problem with the software. Ftgatedump.fts script
doesn't provide proper privilege checking so you don't
need to have administrator's privilege to access to
that script.

Ftgatedump.fts script will dump various information
about your current FTGate Pro configuration to
x:\Program Files\FTGate\ftgate_dump.txt and allow you
to view the file by sending
http://www.victim.com:8089/tools/ftgatedump.fts?command=1
request to the server.

[Vulnerability #2] FTGate Pro Username and Password
exposures

Exportmbx.fts just does exactly what it say "exports
the mailboxes for a domain to a text file" and it
encounters the same problem like the ftgatedump.fts
script, no admin's credential is necessary to access
and execute the script therefore anyone could just
export mailboxes of any local domain into a file (CSV
format) and the file is located in the FTGate program
directory. Make sure you check the "Export Password"
option before exporting the mailbox.

Exportmbx.fts script does not have an option for you
to view the file like the ftgatedump.fts does but you
can get around that by either making exportmbx.fts
script export to a file named "ftgate_dump.txt" and
use the ftgatedump.fts script to view the file or you
can export it to FTGate server's root directory and
download it, there you have it folks.

VENDOR STATUS
==============
Vendor has verified and released a patch that fixes
the issues. Available at
http://www.floosietek.com/files/ftgate12.exe

Author: Phuong Nguyen

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com