Secunia Research: Winmail Server Multiple Vulnerabilities
======================================================================
Secunia Research 18/11/2005
- Winmail Server Multiple Vulnerabilities -
======================================================================
Table of Contents
Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerabilities.......................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
About Secunia........................................................8
Verification.........................................................9
======================================================================
1) Affected Software
Winmail Server 4.2 (build 0824)
Other versions may also be affected.
======================================================================
2) Severity
Rating: Moderately critical
Impact: Manipulation of data and cross-site scripting
Where: Remote
======================================================================
3) Vendor's Description of Software
Winmail Server is an enterprise class mail server software system
offering a robust feature set, including extensive security measures.
Winmail Server supports SMTP, POP3, IMAP, Webmail, LDAP, multiple
domains, SMTP authentication, spam protection, anti-virus protection,
SSL/TLS security, Network Storage, remote access, Web-based
administration, and a wide array of standard email options such as
filtering, signatures, real-time monitoring, archiving, and public
email folders.
Product link:
http://www.magicwinmail.net/
======================================================================
4) Description of Vulnerabilities
Secunia Research has discovered some vulnerabilities in
Winmail Server, which can be exploited by malicious people to conduct
cross-site scripting and script insertion attacks, and overwrite
arbitrary files.
1) Input passed to the "sid" parameter in "admin/main.php" isn't
properly verified, before it is used to create session files. This
can be exploited to overwrite arbitrary files with session
information via directory traversal attacks.
2) Input passed to the "retid" parameter in "badlogin.php" isn't
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.
3) Input passed in the mail body and the "Content-Type" header of
incoming HTML mails isn't properly sanitised before being displayed
to the user. This can be exploited to inject arbitrary HTML and
script code, which will be executed in a user's browser session in
context of an affected site when the malicious mail is viewed.
Example:
A "javascript:" URL in an iframe tag. Other variants are also possible.
4) The problem is that attachments of incoming mails are opened
insecurely in the browser. This can be exploited to execute arbitrary
HTML and script code in a user's browser session in context of an
affected site by tricking a user into opening a malicious attachment.
The vulnerabilities have been confirmed in version 4.2 (build 0824).
Other versions may also be affected.
======================================================================
5) Solution
Edit the source code to ensure that input is properly sanitised.
======================================================================
6) Time Table
28/10/2005 - Vendor notified.
18/11/2005 - Public disclosure.
======================================================================
7) Credits
Discovered by Secunia Research.
======================================================================
8) About Secunia
Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:
http://secunia.com/
Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/secunia_security_advisories/
======================================================================
9) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2005-58/advisory/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
======================================================================