OMail Webmail Remote Command Execution Vulnerability
BID:8451
Info
OMail Webmail Remote Command Execution Vulnerability
| Bugtraq ID: | 8451 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 19 2003 12:00AM |
| Updated: | Aug 19 2003 12:00AM |
| Credit: | The disclosure of this vulnerability has been credited to Phillip Whelan <[email protected]>. |
| Vulnerable: |
OMail OMail webmail 0.98.3 OMail OMail webmail 0.97.3 |
| Not Vulnerable: |
OMail OMail webmail 0.98.5 |
Discussion
OMail Webmail Remote Command Execution Vulnerability
It has been reported that OMail webmail contains an input validation error due to insufficient sanitization of shell metacharacters in the checklogin() function.
This problem could allow a remote attacker to access sensitive user e-mails or run arbitrary commands on the vulnerable host in order to compromise a system.
It has been reported that OMail webmail contains an input validation error due to insufficient sanitization of shell metacharacters in the checklogin() function.
This problem could allow a remote attacker to access sensitive user e-mails or run arbitrary commands on the vulnerable host in order to compromise a system.
Exploit / POC
OMail Webmail Remote Command Execution Vulnerability
This issue may be exploited with a web browser.
This issue may be exploited with a web browser.
Solution / Fix
OMail Webmail Remote Command Execution Vulnerability
Solution:
The vendor has released an upgrade to address this issue. Fixes are linked below. Users who are affected by this vulnerability are advised to update as soon as possible.
The following solution for this problem was provided, however Symantec has not verified the validity of this patch:
--- omail-webmail-0.98.4/omail-old.pl 2001-08-26
08:35:27.000000000 -0400
+++ omail-webmail-0.98.4/omail.pl 2003-07-28
12:29:36.000000000 -0400
@@ -396,7 +396,7 @@
if (($vmailmgr || $vpopmail) && $cgi_mode eq "suid") {
- if (!($userid =~ /(.*)\@(.*)/)) {
+ if (!($userid =~ /([A-Z,a-z,0-9]*)\@([\w\.]*)$/)) {
omailerror("domain name is missing : format
userid\@domain");
} else {
$userid = $1;
@@ -406,7 +406,7 @@
my $password = param("password");
- $password =~ /^(.+)$/;
+ $password =~ /^([^\"]+)$/;
$password = $1;
# 8 possible cases :
OMail OMail webmail 0.97.3
OMail OMail webmail 0.98.3
Solution:
The vendor has released an upgrade to address this issue. Fixes are linked below. Users who are affected by this vulnerability are advised to update as soon as possible.
The following solution for this problem was provided, however Symantec has not verified the validity of this patch:
--- omail-webmail-0.98.4/omail-old.pl 2001-08-26
08:35:27.000000000 -0400
+++ omail-webmail-0.98.4/omail.pl 2003-07-28
12:29:36.000000000 -0400
@@ -396,7 +396,7 @@
if (($vmailmgr || $vpopmail) && $cgi_mode eq "suid") {
- if (!($userid =~ /(.*)\@(.*)/)) {
+ if (!($userid =~ /([A-Z,a-z,0-9]*)\@([\w\.]*)$/)) {
omailerror("domain name is missing : format
userid\@domain");
} else {
$userid = $1;
@@ -406,7 +406,7 @@
my $password = param("password");
- $password =~ /^(.+)$/;
+ $password =~ /^([^\"]+)$/;
$password = $1;
# 8 possible cases :
OMail OMail webmail 0.97.3
-
OMail omail-webmail-0.98.5.tar.gz
http://prdownloads.sourceforge.net/omail/omail-webmail-0.98.5.tar.gz
OMail OMail webmail 0.98.3
-
OMail omail-webmail-0.98.5.tar.gz
http://prdownloads.sourceforge.net/omail/omail-webmail-0.98.5.tar.gz
References
OMail Webmail Remote Command Execution Vulnerability
References:
References:
- OMail webmail (OMail)
- Re: Remote Execution of Commands in Omail Webmail 0.98.4 and earlier ("Olivier M."