Outblaze Webmail Cookie Authentication Bypass Vulnerability

Bugtraq ID:	7115
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 17 2003 12:00AM
Updated:	Mar 17 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to "dong-h0un U" <[email protected]>.
Vulnerable:	Outblaze Webmail 0
Not Vulnerable:

Outblaze Webmail Cookie Authentication Bypass Vulnerability

Outblaze web mail service has been reported prone to an authentication cookie spoofing vulnerability.

This issue may allow a malicious attacker to bypass the cookie-based authentication mechanisms used by the affected Outblaze web mail server. If successful the attacker may obtain the victim's authentication credentials and gain full access to the victim's e-mail account.

Outblaze Webmail Cookie Authentication Bypass Vulnerability

Exploit contributed by "dong-h0un U" <[email protected]>.

• /data/vulnerabilities/exploits/0x82-eat_outblaze_0dayxpl.c

Outblaze Webmail Cookie Authentication Bypass Vulnerability

Solution:
Additional information has been released suggesting that this issue has been addressed by Outblaze. This information however, has not been confirmed.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Outblaze Webmail Cookie Authentication Bypass Vulnerability

References:

• Outblaze HomePage (Outblaze)
  
• [INetCop Security Advisory] ++Danger++ Outblaze Web based e-mail ("dong-h0un U" )
  
• Re: [INetCop Security Advisory] ++Danger++ Outblaze Web based (Suresh Ramasubramanian )