BID:7501

CommuniGate Pro Webmail Session Hijacking Vulnerability

Info

CommuniGate Pro Webmail Session Hijacking Vulnerability

Bugtraq ID:	7501
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 05 2003 12:00AM
Updated:	May 05 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Yaroslav Polyakov <[email protected]>.
Vulnerable:	Stalker Communigate Pro 4.0.6 Stalker Communigate Pro 4.0.3 Stalker Communigate Pro 4.0.2 Stalker Communigate Pro 4.0.1 Stalker Communigate Pro 4.0 b3 Stalker Communigate Pro 4.0 b2 Stalker Communigate Pro 3.4 b3 Stalker Communigate Pro 3.3.2 Stalker Communigate Pro 3.3 b2 - Linux kernel 2.3 .x - Linux kernel 2.2 .x - Linux kernel 2.1 .x Stalker Communigate Pro 3.3 b1 - Linux kernel 2.3 .x - Linux kernel 2.2 .x - Linux kernel 2.1 .x Stalker Communigate Pro 3.2.4 - BSDI BSD/OS 4.0 - BSDI BSD/OS 3.0 - BSDI BSD/OS 2.0 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 3.5 - FreeBSD FreeBSD 3.4 - FreeBSD FreeBSD 3.3 - FreeBSD FreeBSD 3.2 - FreeBSD FreeBSD 3.1 - HP HP-UX 11.0 - HP HP-UX 10.0 - IBM AIX 4.3 - IBM AIX 4.2 - IBM AIX 4.1 - Linux kernel 2.3 .x - Linux kernel 2.2 .x - Linux kernel 2.1 .x - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - SCO Unixware 7.1 - SCO Unixware 7.0 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 6.2 - SGI IRIX 6.1 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 Stalker Communigate Pro 3.2 b7 Stalker Communigate Pro 3.2 b5 Stalker Communigate Pro 3.1 - BSDI BSD/OS 4.0 - BSDI BSD/OS 3.0 - BSDI BSD/OS 2.0 - Digital UNIX 4.0 - FreeBSD FreeBSD 3.3 - FreeBSD FreeBSD 3.2 - FreeBSD FreeBSD 3.1 - FreeBSD FreeBSD 3.0 - HP HP-UX 10.0 - IBM AIX 4.3 - IBM AIX 4.2 - IBM AIX 4.1 - Linux kernel 2.3 - Linux kernel 2.2 - Linux kernel 2.1 - Linux kernel 2.0 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 - SCO Unixware 7.1 - SCO Unixware 7.0 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 6.2 - SGI IRIX 6.1 - SGI IRIX 6.0 - Sun Solaris 7.0_x86 - Sun Solaris 7.0

Not Vulnerable:	Stalker Communigate Pro 4.0 .1b2

Discussion

CommuniGate Pro Webmail Session Hijacking Vulnerability

CommuniGate Pro Webmail has been reported prone to a session hijacking vulnerability. The vulnerability presents itself when the victim views an image or similar resource embedded in a HTML web-mail.

The attacker may intercept the HTTP header and extract URL data contained within. The attacker may use this data, within a certain time frame, to hijack the current user session.

Exploit / POC

CommuniGate Pro Webmail Session Hijacking Vulnerability

The following proof of concept exploit has been provided:

/data/vulnerabilities/exploits/shj.pl

Solution / Fix

CommuniGate Pro Webmail Session Hijacking Vulnerability

Solution:
The vendor has addressed this vulnerability in version '4.1b2' of the product. Customers are advised to upgrade and employ 'UseCookies' option during configuration of the server.

Stalker Communigate Pro 3.1