Mailtraq Administration Console Local Privilege Escalation Vulnerability

Bugtraq ID:	11708
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Nov 19 2004 12:00AM
Updated:	Nov 19 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to Reed Arvin <[email protected]>.
Vulnerable:	Mailtraq Mailtraq 2.3.2 .1419 Mailtraq Mailtraq 2.1 .0.1302 Mailtraq Mailtraq 2.6.1.1677
Not Vulnerable:

Mailtraq Administration Console Local Privilege Escalation Vulnerability

Mailtraq allows a user to activate the Mailtraq administration console software by easily launching the software from an icon in the Windows system tray. It is reported that a local user may exploit the administration console interface to escalate privileges.

Mailtraq Administration Console Local Privilege Escalation Vulnerability

No exploit is required. The following example is available:

1. Double click on the Mailtraq icon in the Taskbar
2. Right click in the right text pane and choose View Source
3. Notepad should open. Click File, click Open
4. In the Files of type: field choose All Files
5. Navagate to '%WINDIR%\System32'. Right click on 'cmd.exe' and choose Open
7. A command prompt will launch with SYSTEM privileges

Mailtraq Administration Console Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Mailtraq Administration Console Local Privilege Escalation Vulnerability

References:

• Mailtraq Product Page (Mailtraq)
  
• Privilege escalation in Mailtraq Version 2.6.1.1677. (Reed Arvin )