====================================================================== Secunia Research 18/11/2005 - Winmail Server Multiple Vulnerabilities - ====================================================================== Table of Contents Affected Software....................................................1 Severity.............................................................2 Vendor's Description of Software.....................................3 Description of Vulnerabilities.......................................4 Solution.............................................................5 Time Table...........................................................6 Credits..............................................................7 About Secunia........................................................8 Verification.........................................................9 ====================================================================== 1) Affected Software Winmail Server 4.2 (build 0824) Other versions may also be affected. ====================================================================== 2) Severity Rating: Moderately critical Impact: Manipulation of data and cross-site scripting Where: Remote ====================================================================== 3) Vendor's Description of Software Winmail Server is an enterprise class mail server software system offering a robust feature set, including extensive security measures. Winmail Server supports SMTP, POP3, IMAP, Webmail, LDAP, multiple domains, SMTP authentication, spam protection, anti-virus protection, SSL/TLS security, Network Storage, remote access, Web-based administration, and a wide array of standard email options such as filtering, signatures, real-time monitoring, archiving, and public email folders. Product link: http://www.magicwinmail.net/ ====================================================================== 4) Description of Vulnerabilities Secunia Research has discovered some vulnerabilities in Winmail Server, which can be exploited by malicious people to conduct cross-site scripting and script insertion attacks, and overwrite arbitrary files. 1) Input passed to the "sid" parameter in "admin/main.php" isn't properly verified, before it is used to create session files. This can be exploited to overwrite arbitrary files with session information via directory traversal attacks. 2) Input passed to the "retid" parameter in "badlogin.php" isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. 3) Input passed in the mail body and the "Content-Type" header of incoming HTML mails isn't properly sanitised before being displayed to the user. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious mail is viewed. Example: A "javascript:" URL in an iframe tag. Other variants are also possible. 4) The problem is that attachments of incoming mails are opened insecurely in the browser. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site by tricking a user into opening a malicious attachment. The vulnerabilities have been confirmed in version 4.2 (build 0824). Other versions may also be affected. ====================================================================== 5) Solution Edit the source code to ensure that input is properly sanitised. ====================================================================== 6) Time Table 28/10/2005 - Vendor notified. 18/11/2005 - Public disclosure. ====================================================================== 7) Credits Discovered by Secunia Research. ====================================================================== 8) About Secunia Secunia collects, validates, assesses, and writes advisories regarding all the latest software vulnerabilities disclosed to the public. These advisories are gathered in a publicly available database at the Secunia website: http://secunia.com/ Secunia offers services to our customers enabling them to receive all relevant vulnerability information to their specific system configuration. Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/secunia_security_advisories/ ====================================================================== 9) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2005-58/advisory/ Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/ ======================================================================