GFI Mail Essentials BCC Information Disclosure Vulnerability

Bugtraq ID:	3671
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 12 2001 12:00AM
Updated:	Dec 12 2001 12:00AM
Credit:	This vulnerability was submitted to BugTraq on December 12th, 2001 by Ronan Waide <[email protected]>.
Vulnerable:	GFI Mail Essentials 2000 SP1 - Microsoft Exchange Server 5.5 SP4 - Microsoft Exchange Server 5.5 SP3 - Microsoft Exchange Server 5.5 SP2 - Microsoft Exchange Server 5.5 SP1 - Microsoft Exchange Server 5.5 - Microsoft Exchange Server 2000 SP1 - Microsoft Exchange Server 2000 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional GFI Mail Essentials 2000 - Microsoft Exchange Server 5.5 SP4 - Microsoft Exchange Server 5.5 SP3 - Microsoft Exchange Server 5.5 SP2 - Microsoft Exchange Server 5.5 SP1 - Microsoft Exchange Server 5.5 - Microsoft Exchange Server 2000 SP1 - Microsoft Exchange Server 2000 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional GFI Mail Essentials 5.0 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0
Not Vulnerable:

GFI Mail Essentials BCC Information Disclosure Vulnerability

Mail Essentials is a commercial e-mail anti-virus and content scanner product, developed and maintained by GFI.

Mail Essentials does not properly handle BCC headers, disclosing the first name on the blind carbon copy list to all recipients of a BCC'ed message.

As a result, the effectiveness of BCC can not be trusted when doing mass-mailings.

GFI Mail Essentials BCC Information Disclosure Vulnerability

There is no exploit code required. The sensitive information is automatically disclosed when the BCC'ed message passes through the Mail Essentials filter.

GFI Mail Essentials BCC Information Disclosure Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

GFI Mail Essentials BCC Information Disclosure Vulnerability

References:

• Mail Essentials Product Page (GFI Software)