bugtraq - [SIG^2 G-TEC] CMailServer WebMail v5.2 Multiple Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 24 Nov 2004 20:51:18 -0000
From: <chewkeong@...urity.org.sg>
To: bugtraq@...urityfocus.com
Subject: [SIG^2 G-TEC] CMailServer WebMail v5.2 Multiple Vulnerabilities

SIG^2 Vulnerability Research Advisory

CMailServer WebMail v5.2 Multiple Vulnerabilities

by Tan Chew Keong
Release Date: 24 Nov 2004

ADVISORY URL
http://www.security.org.sg/vuln/cmailserver52.html

SUMMARY

CMailServer (http://www.youngzsoft.net/cmailserver/) is a small and easy-to-use Mail Server software and Web Mail software. It enables you to send and receive emails across the Internet or within the LAN and has support for client email applications such as Outlook, Eudora etc. CMailServer supports Hotmail-like Web Mail service based on ASP scripts.

Multiple vulnerabilies were found in CMailServer's Web Mail service including buffer overflow, SQL Injection and Cross-Site Scripting (XSS).

TESTED SYSTEM

CMailServer Version 5.2 on English Win2K IIS 5.0.

DETAILS

CMailServer is a small and easy-to-use Mail Server software and Web Mail software. It enables you to send and receive emails across the Internet or within the LAN and has support for client email applications such as Outlook, Eudora etc. CMailServer supports Hotmail-like Web Mail service based on ASP scripts. Multiple vulnerabilies were found in CMailServer's Web Mail service including buffer overflow, SQL Injection and Cross-Site Scripting (XSS).

1. Buffer overflow in CMailCOM.dll's attachment download method may allow arbitrary code execution.

2. SQL Injection in fdelmail.asp allows deleting of other users' mail metadata.

3. SQL Injection in addressc.asp allows deleting of other users' email address contacts.

4. XSS vulnerability in admin.asp when displaying users' personal info.

PATCH

Upgrade to the latest version of CMailServer v5.2.1.

DISCLOSURE TIMELINE

12 Nov 04 - Vulnerability Discovered.
13 Nov 04 - Initial Vendor Notification by Email and Web Form.
16 Nov 04 - Initial Vendor Reply.
21 Nov 04 - Vendor provided patched version for testing.
21 Nov 04 - Notified Vendor that a patch did not work.
21 Nov 04 - Vendor provided updated version for testing.
24 Nov 04 - Public Release

GREETINGS

All guys at SIG^2 G-TEC Lab
http://www.security.org.sg/webdocs/g-tec.html 

"IT Security...the Gathering. By enthusiasts for enthusiasts."