IceWarp Server Multiple Remote Vulnerabilities

Bugtraq ID:	45222
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 07 2010 12:00AM
Updated:	Dec 07 2010 12:00AM
Credit:	Ron Ott and Mike Schneider, GO OUT Production GmbH and Thomas Wittmann, Wittmann Security Consulting
Vulnerable:	IceWarp IceWarp Server 10.2
Not Vulnerable:	IceWarp IceWarp Server 10.2.1

IceWarp Server Multiple Remote Vulnerabilities

IceWarp Server is prone to multiple remote vulnerabilities, including cross-site scripting, HTML-injection, and directory-traversal vulnerabilities.

An attacker may leverage these issues to read arbitrary files in the context of the affected server and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.

IceWarp Server versions prior to 10.2.1 are vulnerable.

IceWarp Server Multiple Remote Vulnerabilities

Attackers can exploit these issues using a browser.

IceWarp Server Multiple Remote Vulnerabilities

Solution:
Reportedly, the vendor has released an upgrade (version 10.2.1).

IceWarp Server Multiple Remote Vulnerabilities

References:

• IceWarp Homepage (IceWarp)
  
• IceWarp Server Multiple Security Vulnerabilities (IceWarp)