Secunia Research: Winmail Server Multiple Vulnerabilities

[Secunia Research <vuln () secunia com>]

======================================================================

                     Secunia Research 18/11/2005

              - Winmail Server Multiple Vulnerabilities -

======================================================================
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerabilities.......................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
About Secunia........................................................8
Verification.........................................................9

======================================================================
1) Affected Software

Winmail Server 4.2 (build 0824)

Other versions may also be affected.

======================================================================
2) Severity

Rating: Moderately critical
Impact: Manipulation of data and cross-site scripting
Where:  Remote

======================================================================
3) Vendor's Description of Software

Winmail Server is an enterprise class mail server software system 
offering a robust feature set, including extensive security measures. 
Winmail Server supports SMTP, POP3, IMAP, Webmail, LDAP, multiple 
domains, SMTP authentication, spam protection, anti-virus protection, 
SSL/TLS security, Network Storage, remote access, Web-based 
administration, and a wide array of standard email options such as 
filtering, signatures, real-time monitoring, archiving, and public 
email folders.

Product link:
http://www.magicwinmail.net/

======================================================================
4) Description of Vulnerabilities

Secunia Research has discovered some vulnerabilities in 
Winmail Server, which can be exploited by malicious people to conduct 
cross-site scripting and script insertion attacks, and overwrite 
arbitrary files.

1) Input passed to the "sid" parameter in "admin/main.php" isn't 
properly verified, before it is used to create session files. This 
can be exploited to overwrite arbitrary files with session 
information via directory traversal attacks.

2) Input passed to the "retid" parameter in "badlogin.php" isn't 
properly sanitised before being returned to the user. This can be 
exploited to execute arbitrary HTML and script code in a user's 
browser session in context of an affected site.

3) Input passed in the mail body and the "Content-Type" header of 
incoming HTML mails isn't properly sanitised before being displayed 
to the user. This can be exploited to inject arbitrary HTML and 
script code, which will be executed in a user's browser session in 
context of an affected site when the malicious mail is viewed.

Example:
A "javascript:" URL in an iframe tag. Other variants are also possible.

4) The problem is that attachments of incoming mails are opened 
insecurely in the browser. This can be exploited to execute arbitrary 
HTML and script code in a user's browser session in context of an 
affected site by tricking a user into opening a malicious attachment.

The vulnerabilities have been confirmed in version 4.2 (build 0824). 
Other versions may also be affected.

======================================================================
5) Solution

Edit the source code to ensure that input is properly sanitised.

======================================================================
6) Time Table

28/10/2005 - Vendor notified.
18/11/2005 - Public disclosure.

======================================================================
7) Credits

Discovered by Secunia Research.

======================================================================
8) About Secunia

Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:

http://secunia.com/

Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/secunia_security_advisories/

======================================================================
9) Verification

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2005-58/advisory/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/