IceWarp Merak Mail Server 'Forgot Password' Input Validation Vulnerability
BID:34827
Info
IceWarp Merak Mail Server 'Forgot Password' Input Validation Vulnerability
| Bugtraq ID: | 34827 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-1469 |
| Remote: | Yes |
| Local: | No |
| Published: | May 05 2009 12:00AM |
| Updated: | May 06 2009 04:46PM |
| Credit: | RedTeam Pentesting GmbH |
| Vulnerable: |
IceWarp Merak Mail Server 9.4.1 |
| Not Vulnerable: |
IceWarp Merak Mail Server 9.4.2 |
Discussion
IceWarp Merak Mail Server 'Forgot Password' Input Validation Vulnerability
IceWarp Merak Mail Server is prone to an input-validation vulnerability because it uses client-supplied data when performing a 'Forgot Password' function.
Attackers can exploit this issue via social-engineering techniques to obtain valid users' login credentials; other attacks may also be possible.
IceWarp Merak Mail Server is prone to an input-validation vulnerability because it uses client-supplied data when performing a 'Forgot Password' function.
Attackers can exploit this issue via social-engineering techniques to obtain valid users' login credentials; other attacks may also be possible.
Exploit / POC
IceWarp Merak Mail Server 'Forgot Password' Input Validation Vulnerability
To exploit this issue, an attacker must entice an unsuspecting user into replying to a malicious email.
The following malicious email generator is available:
To exploit this issue, an attacker must entice an unsuspecting user into replying to a malicious email.
The following malicious email generator is available:
Solution / Fix
IceWarp Merak Mail Server 'Forgot Password' Input Validation Vulnerability
Solution:
The vendor has released an update. Please see the references for details.
Solution:
The vendor has released an update. Please see the references for details.
References
IceWarp Merak Mail Server 'Forgot Password' Input Validation Vulnerability
References:
References:
- IceWarp Homepage (IceWarp)
- IceWarp WebMail Server: Client-Side Specification of Forgot Password eMail Conte (RedTeam Pentesting GmbH)
- [RT-SA-2009-004] IceWarp WebMail Server: Client-Side Specification of "Forgot Pa (RedTeam Pentesting GmbH