Marshal MailMarshal SMTP Spam Quarantine Management Multiple HTML Injection Vulnerabilities

Bugtraq ID:	31483
Class:	Input Validation Error
CVE:	CVE-2008-2831
Remote:	Yes
Local:	No
Published:	Sep 25 2008 12:00AM
Updated:	Sep 30 2008 07:29PM
Credit:	Dr. Marian Ventuneac, Data Communication Security Laboratory, Department of Electronic & Computer Engineering, University of Limerick
Vulnerable:	Marshal MailMarshal SMTP 6.2.1 Marshal MailMarshal SMTP 6.2 Marshal MailMarshal SMTP 6.1.9 Marshal MailMarshal SMTP 6.1.8 Marshal MailMarshal SMTP 6.3 Marshal MailMarshal SMTP 6.1 Marshal MailMarshal SMTP 6.0
Not Vulnerable:	Marshal MailMarshal SMTP 6.4

Marshal MailMarshal SMTP Spam Quarantine Management Multiple HTML Injection Vulnerabilities

Marshal MailMarshal SMTP Spam Quarantine Management component is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Reportedly, the attacker may be able to further exploit these issues to install arbitrary files on a victim's computer.

These issues affect MailMarshal SMTP 6.0 up to and including 6.3.

Marshal MailMarshal SMTP Spam Quarantine Management Multiple HTML Injection Vulnerabilities

Attackers can exploit these issues via a browser.

Marshal MailMarshal SMTP Spam Quarantine Management Multiple HTML Injection Vulnerabilities

Solution:
The vendor has released fixes. Please see the references for more information.

Marshal MailMarshal SMTP Spam Quarantine Management Multiple HTML Injection Vulnerabilities

References:

• Marshal MailMarshal Web Site (Marshal)
  
• MailMarshal Spam Quarantine Management Cross-Site Scripting Vulnerability (CVE N (Data Communication Security Laboratory)
  
• Q12175 - BUG: MailMarshal SQM Vulnerability (Marshal)