Message-ID: <20031025190426.29685.qmail@web20205.mail.yahoo.com>
Date: Sat, 25 Oct 2003 12:04:26 -0700 (PDT)
From: bipin gautam <visitbipin@...oo.com>
To: full-disclosure@...ts.netsys.com, bugtraq@...urityfocus.com,
   office@...labs.com
Subject: Some serious security holes in 'The Bat!'


'The Bat!' [http://www.ritlabs.com/] is a powerful,
highly configurable, MULTI-USER, yet easy to use email
client.

I have discoverd some serious security holes in 'The
Bat!'

mmm..., when a new account is created in 'The Bat!' It
creates the account in %programfiledir%\The Bat!\MAIL\
without implimenting any proper ACL! so even a guest
USER IS ABLE TO READ! THE "MESSAGES.TBB"
"MESSAGES.TBI" of both 'INBOX' AND 'OUTBOX' by just
creating a new account [in a local or remote PC] and
putting the files in the NEW USERS 'inbox' and
'outbox' and using ! The Bat! itself to READ THE
FILE/email's.


More sevier, "MESSAGES.TBB" and "MESSAGES.TBI" are
stored in PLAIN TEXT!!!

Even worst! The Bat! stores the password in
Account.cfg of the users directory... [say...
%programfiledir%\The Bat!\MAIL\NEW_USER\] If there is
another user have equal right's! he could just delete
the account.cfg and READ another USER'S PASSWORD
PROTECTED EMAIL WITHOUT ANY
PROBLEM's!!!/RESTRICTION!!!

---------------------
FUNNY
---------------------
I copied the ACCOUNT.CFG file from the
%programfiledir%\The Bat!\MAIL\ADMINISTRATOR\

I WAS ABLE TO inject the encrypted password of mine
[simply, using a hex editor] into the ACCOUNT.CFG of
\ADMINISTRATOR\ by copying it to a new directory and
then making few email adjustments etc... i was
completely able to, not only HIJACK "MESSAGES.TBB" and
"MESSAGES.TBI"
of the admin. account but also TAKING
CONTROL/ACCESSING/USE ACCOUNT.CFG of the ADMINistrator
form a guest account.

------------------------------------------------
 Some possible solution, until update's are relesed!
------------------------------------------------
Creating the new user account in %userprofile% [when
possible] insted of %programfiledir%\The Bat!\MAIL\ or
changing path of The Bat! folder to %userprofile% so
that ACL's of NTFS will handle the rest!

[After you create a new account [folder] in
%userprofile% you could then simply copy all of your
goodees from %programfiledir%\The
Bat!\MAIL\YOUR_ACCOUNT-FILE to
%userprofile%\YOUR_ACCOUNT-FILE \

Checking proper ACL! manually, or implimenting proper
rules by using a 3'rd party software so that it's hard
to SPY INTO "MESSAGES.TBB" and "MESSAGES.TBI" by
unauthorised USER!

--------------------------------
Shouldn't the developer's....
--------------------------------
Store the encrypted password in the headers of
"MESSAGES.TBB" and "MESSAGES.TBI" insted of seperate
file!!! so that 'The Bat!' can effectively check if
the file is password protected or not before it opens
the content!
Encrypting the content's of "MESSAGES.TBB" and
"MESSAGES.TBI" [and other cfg files...] insted of
putting it all in a plain text!!!

I don't think the developrs wanna see a worm that
grep's all the @ [heee... email account's] from
"MESSAGES.TBB" and "MESSAGES.TBI" files AND PLAY
THRASH.....

--[Background Information]--
This bug was originally discovered by hUNT3R, a member
of 01 Security Sumbission. The vendor was notified via
email.
http://www.ysgnet.com/hn




__________________________________
Do you Yahoo!?
The New Yahoo! Shopping - with improved product search
http://shopping.yahoo.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Powered by blists - more mailing lists