ArGoSoft Mail Server Pro Multiple HTML Injection Vulnerabilities

Bugtraq ID:	16834
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 27 2006 12:00AM
Updated:	Mar 01 2006 03:21AM
Credit:	Secunia Research is credited with the discovery of these vulnerabilities.
Vulnerable:	ArGoSoft Mail Server Pro 1.8.8 .5 ArGoSoft Mail Server Pro 1.8.8 .4 ArGoSoft Mail Server Pro 1.8.8 .3 ArGoSoft Mail Server Pro 1.8.8 .1 ArGoSoft Mail Server Pro 1.8.7 .6 ArGoSoft Mail Server Pro 1.8.7 .4 ArGoSoft Mail Server Pro 1.8.7 .3 ArGoSoft Mail Server Pro 1.8.7 .1 ArGoSoft Mail Server Pro 1.8.7 .0 ArGoSoft Mail Server Pro 1.8.6 .9 ArGoSoft Mail Server Pro 1.8.6 .8 ArGoSoft Mail Server Pro 1.8.6 .7 ArGoSoft Mail Server Pro 1.8.6 .6 ArGoSoft Mail Server Pro 1.8.6 .5 ArGoSoft Mail Server Pro 1.8.6 .4 ArGoSoft Mail Server Pro 1.8.6 .3 ArGoSoft Mail Server Pro 1.8.6 .2 ArGoSoft Mail Server Pro 1.8.6 .1 ArGoSoft Mail Server Pro 1.8.1 .9 ArGoSoft Mail Server Pro 1.8.1 .8 ArGoSoft Mail Server Pro 1.8.1 .7 ArGoSoft Mail Server Pro 1.8 .1.6 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional ArGoSoft Mail Server Pro 1.8 .1.5 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional ArGoSoft Mail Server Pro 1.8.8.2
Not Vulnerable:	ArGoSoft Mail Server Pro 1.8.8 .6

ArGoSoft Mail Server Pro Multiple HTML Injection Vulnerabilities


ArGoSoft Mail Server Pro is prone to multiple HTML-injection vulnerabilities. The application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

ArGoSoft Mail Server Pro 1.8.8.5 and prior versions are vulnerable.

ArGoSoft Mail Server Pro Multiple HTML Injection Vulnerabilities


An exploit is not required.

ArGoSoft Mail Server Pro Multiple HTML Injection Vulnerabilities

Solution:

The vendor has released version 1.8.8.6 to address these issues. Please contact the vendor to obtain fixes.

ArGoSoft Mail Server Pro Multiple HTML Injection Vulnerabilities

References:

• ArGoSoft Mail Server Pro viewheaders Script Insertion (Secunia)
  
• List of Changes (ArGo Software Design)
  
• Mail Server Homepage (ArGoSoft)