Comcast(tm) Email Manager allows arbitrary java and activex code execution
Vulnerability in Comcast Webmail Manager allows arbitrary java and activex code
execution
Systems: Comcast Webmail email system. www.comcast.net
Vulnerable: X-Mailer: AT&T Message Center Version 1 (Mar 22 2004)
Not Vulnerable: Unknown
Severity: Serious / Low (Fixed now)
Category: Arbitrary Execution of Code of Hackers Choice
Classification: Input Validation Error
BugTraq-ID: TBA
CVE-Number: TBA
Remote Exploit: yes
Local Exploit: no
Vendor URL: www.comcast.net
Author: Michael S. Scheidell, SECNAP Network Security
Original Release date: April 7, 2004
Notifications: Comcast notified April 7, 2004
Public Release date: July 22, 2004
Discussion: from www.comcast.com
High-Speed Internet. This is the fastest way to travel the Web! It's
cable-powered, so it's always connected and you won't tie up your phone lines.
It's a faster, more powerful and more convenient Internet experience.
Note: This is not so much a warning to Comcast or their users, since Comcast
has fixed this problem, but more of a warning to every developer or CSIO to
make sure that web based email, blogs, information, memos must check their code
to make sure it is safe. See additional notifications of similar problems with
GoldMine(tm) http://www.secnap.com/security/gm001.html, and sprintmail picture
mail at http://www.secnap.com/security/030711.html
Problem: There was a potential for hackers to use this vulnerability to
specially craft emails that will run random code of their choice on users'
computers - including remote Trojans, irc zombies, spyware, malware, and remote
key loggers. This program would run inside the corporate network, behind the
firewall and access anything the infected user has access to.
The Comcast Webmail did not run the html email in the 'security zone' as does
Microsoft(tm) Outlook, but passed anything that looks like HTML to be executed
unrestricted directly to the default Browser (usually IE). Linux/or Unix users
with Netscape may have the javascript, page redirection and popup email run,
however, the activeX component will not run.
Comcast users have the option of using Comcast Webmail or Outlook Express.
Because of the inability to disable html/java/or active-x in Comcast Webmail,
those using Webmail had an increased chance of their computers' becoming
infected in the event of a potential hacker either a) referencing active-x
controls or b) including javascript within an HTML e-mail message.
The above has been tested on a Windows(tm) 2000 system with service pack 4, all
Internet Explorer patches and default (factory) Internet zone security
settings. Also tested were two Windows XP(tm) systems with service pack 1 and
all patches as well as Netscape 7.1 on Linux.
The security community first became aware of the potential for this kind of
threat about two years ago. Software companies that produce Web-based email,
blog or input system must check for arbitrary java and html code. Note: the
original Web Mail system was written by AT&T and was inherited by Comcast
during their purchase of AT&T's broadband business.
Exploit: No exploit is necessary, as there are already examples in viruses and
trojans that were designed to attack Microsoft Outlook and Outlook Express.
Microsoft fixed these by patching both readers and allowing the user to set the
security zone for reading HTML email in the 'insecure' settings.
To see an exhaustive list of what can happen when email is passed to IE, see
<http://www.guninski.com/browsers.html>
Vendor Response: April 7, 2004. A Comcast representative called our office
immediately. Comcast worked quickly on fixing this bug and rolling it out to
their servers, with a solution in place by April 13, 2004. Release of this
notification was held back waiting for Comcast to decide how and when to
self-release.
Solution:
Comcast is now filtering out various forms of scripting.
Credit:
Michael Scheidell, SECNAP Network Security, www.secnap.com
The original problem with IIE, Microsoft Outlook and Outlook Express was found
by George Grunski and involved insecure default reading of a malformed HTML in
Outlook and OE and insecure running of HTML (see
<http://www.guninski.com/browsers.html>) And thanks to Johannes B. Ullrich, CTO
SANS Internet Storm Center for assistance.
Original copy of this report can be found here
<http://www.secnap.com/security/20040406.html>
Copyright:
Above Copyright(c) 2004, SECNAP Network Security Corporation. World rights
reserved.
This security report can be copied and redistributed electronically provided it
is not edited and is quoted in its entirety without written consent of SECNAP
Network Security Corporation. Additional information or permission may be
obtained by contacting SECNAP Network Security at 561-999-5000