| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: 29 Jan 2005 01:05:54 -0000 From: ShineShadow <ss_contacts@...mail.com> To: bugtraq@...urityfocus.com Subject: Multiple vulnerabilities in Icewarp Web Mail 5.3.0: New holes ShineShadow Security Report 26012005-03 TITLE: Multiple vulnerabilities in Icewarp Web Mail 5.3.0 : New holes. BACKGROUND Merak Mail Server, with the revolutionary Merak Mail Server GroupWare Server, cutting-edge Merak Mail Server Instant Antispam and much more, is the fastest, most stable, secure and 100% virus free mail server on the market today. Every day companies choose Merak Mail Server's stability, speed, security, functionality, scalability and multi-tiered delegated manageability over products costing thousands of dollars more yet lacking the sophistication that Merak delivers. In less than 10 minutes you can have the same professional email server that organizations such as NATO, the U.S. Navy, the FBI, Toyota, the U.S. Government, and many ISP Providers and Developers depend on every day. Source: www.MerakMailServer.com VULNERABLE PRODUCTS MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 MERAK Mail Server 7.6.4r with Icewarp Web Mail 5.3.2 (vulnerabilities #2,#3 only) DETAILS 1. Multiple cross-site scripting (XSS) vulnerabilities. Description: Remote user, who HAS account on Merak Mail Server, can execute cross-site scripting (XSS) attack. Vulnerable pages: login.html accountsettings_add.html calendar_addnote.html calendar_addtask.html calendar_addevent.html Examples: http://localhost:32000/mail/login.html?username=[xss_here] http://localhost:32000/mail/accountsettings_add.html?id=[]&Save_x=1&account[EMAIL]=hacker&account[HOST]=blackhat.org&account[HOSTUSER]=hacker&account[HOSTPASS]=31337&account[HOSTPASS2]=31337&accountid=[xss_here] http://localhost:32000/mail/calendar.html -> AddNote -> [Title]= [xss_here] http://localhost:32000/mail/calendar.html -> AddTask -> [Note]=[xss_here] http://localhost:32000/mail/calendar.html -> AddEvent -> [Note]=[xss_here] http://localhost:32000/mail/calendar.html -> AddEvent -> [Title]= [xss_here] http://localhost:32000/mail/calendar.html -> AddEvent -> [Location]= [xss_here] 2. Full install path disclosure. Description: Remote user, who HAS account on Merak Mail Server, can disclosure full install path of the product. It could be used during attack on an affected system. Vulnerable pages: calendar_d.html calendar_m.html calendar_w.html calendar_y.html Examples: http://localhost:32000/mail/calendar_d.html?id=[sessionid] http://localhost:32000/mail/calendar_m.html?id=[sessionid] http://localhost:32000/mail/calendar_w.html?id=[sessionid] http://localhost:32000/mail/calendar_y.html?id=[sessionid] Note: MERAK Mail Server 7.6.4r with Icewarp Mail Server 5.3.2 also vulnerable to it. 3. Simple encryption of users passwords. Description: Very simple encryption of users passwords in users.cfg, settings.cfg (XOR), users.dat, user.dat (BASE64). If attacker will get access to this files then he could take users and administrators passwords. Vulnerable files: [MerakDir] \config\settings.cfg [MerakDir] \config\ [Domain] \users.cfg [MerakDir] \webmail\config\users.dat [MerakDir] \webmail\users\ [Domain] \ [User] \user.dat Note: MERAK Mail Server 7.6.4r with Icewarp Mail Server 5.3.2 also vulnerable to it. 4. File creation with arbitrary content on remote system. Description: Remote user, who HAS account on Merak Mail Server, can create text file on remote server with arbitrary content (include special characters). Path to the file will be [MerakDir]\webmail\users\[Domain]\[User]\accounts.dat. Vulnerable page: accountsettings_add.html Example: http://localhost:32000/mail/accountsettings_add.html?id=[sessionid]&Save_x=1&account[EMAIL]=hacker&account[HOST]=blackhat.org&account[HOSTUSER]=hacker&account[HOSTPASS]=31337&account[HOSTPASS2]=31337&accountid=[arbitary text] 5. Moving and viewing arbitrary files on remote system. Description: Remote user, who HAS account on Merak Mail Server, can move arbitrary files on local file system of the target. The file will be moved to [MerakDir]\webmail\users\[Domain]\[User] folder and will be renamed to import.tmp. After that attacker can view this file and import/export it to/from address book. This vulnerability could be used for causing denial of service (DOS) conditions or access to arbitrary files on affected system. From files user.dat, users.dat attacker could get users and administrators passwords (vulnerability #3) and take complete control of a Merak Mail Server. With administrator privileges on Merak Mail Server the attacker using [Executables] function of the product could execute arbitrary commands on remote system with mailserver privileges. If Merak Mail Server was been running under administrator account then attacker could take complete control of an affected system. This vulnerability also could be used for verifying existing of the arbitrary files on remote system. Vulnerable page: importaction.html Example: http://localhost:32000/importaction.html?id=[sessionid]&importfile=[arbitrary path]&action=upload&Import=1&importfile_size=1000000 EXPLOITATION IceWarp Web Mail (control.exe service) must be running on Merak Mail Server. Account on Merak Mail Server is needed. WORKAROUND Upgrade to MERAK Mail Server 7.6.4r with Icewarp Web Mail 5.3.2 or disable Icewarp Web Mail service (Control.exe). VENDOR STATUS Not contacted. SUMMARY An attacker who successfully exploited vulnerabilities described in this report could take complete control of a Merak Mail Server 7.6.0 or an affected remote system. Merak Mail Server 7.6.4r with Icewarp Web Mail 5.3.2 also vulnerable to other (undescribed in this report) critical vulnerabilities. An attacker who successfully exploited of this undescribed vulnerabilities could take complete control of a Merak Mail Server or an affected remote system. I am not advice to use this product, you must disable Icewarp Web Mail service. CREDITS ShineShadow, undependent IT security expert. To get more information, please contact me by e-mail. 26.01.2005 ShineShadow, ss_contacts@...mail.com
Powered by blists - more mailing lists