Ipswitch IMail Server User Modification Vulnerability

Bugtraq ID:	3429
Class:	Input Validation Error
CVE:	CVE-2001-1281
Remote:	Yes
Local:	No
Published:	Oct 12 2001 12:00AM
Updated:	Jul 11 2009 09:06AM
Credit:	Discovered and posted to Bugtraq by Arne Vidstrom <[email protected]> on Oct 11, 2001.
Vulnerable:	Ipswitch IMail 7.0.4 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Ipswitch IMail 6.0.6 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 Ipswitch IMail 6.0.2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0
Not Vulnerable:

Ipswitch IMail Server User Modification Vulnerability

Ipswitch IMail is an email server that serves clients their mail via a web interface. IMail supports most common email protocols such as SMTP, POP3, IMAP4, and LDAP etc.

It is possible for an unauthorized user to modify user information in the Web Messaging Service of Ipswitch. It is possible to specify another userid to whom changes in the editing form will be applied by simply modifying a hidden variable.

Successful exploitation of this vulnerability could lead to a denial of service for the victim user.

Ipswitch IMail Server User Modification Vulnerability

There is no exploit required.

Ipswitch IMail Server User Modification Vulnerability

References:

• IMail Server Homepage (Ipswitch)
  
• IMail Server Support Center (IPSwitch)