lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20041118224014.11458.qmail@www.securityfocus.com>
Date: 18 Nov 2004 22:40:14 -0000
From: Reed Arvin <reedarvin@...il.com>
To: bugtraq@...urityfocus.com
Subject: Privilege escalation in Mailtraq Version 2.6.1.1677.




Summary:
A privilege escalation flaw exists in Mailtraq Version 2.6.1.1677 (http://www.mailtraq.com/).

Details:
A privilege escalation technique can be used to gain SYSTEM level access while using the Mailtraq administration console.

Vulnerable Versions:
Mailtraq Version 2.6.1.1677.

Solution:
The vendor was notified. Vendor response:

| This does not appear to be a security hole as the Mailtraq Console
| is intended to be operated only by authorized administrators.  The
| console provides direct access to user data and the ability to
| manipulate e-mail and other sensitive data for all users.  For
| this reason, in environments where non-administrators may be
| granted physical access to the desktop we expect administrators
| to secure the console by password protection.  (This feature is
| enabled in the Server Properties.)  If the console is secured in
| this manner, standard dialog functions such as that you described
| are only available to administrators.

Exploit:
1. Double click on the Mailtraq icon in the Taskbar
2. Right click in the right text pane and choose View Source
3. Notepad should open.  Click File, click Open
4. In the Files of type: field choose All Files
5. Navagate to %WINDIR%\System32\
6. Right click on cmd.exe and choose Open
7. A command prompt will launch with SYSTEM privileges

Discovered by Reed Arvin reedarvin[at]gmail[dot]com


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ