mailing list archives
Re: Multiple Vulnerabilities in SLWebmail
From: H D Moore <slwebmailpost () digitaloffense net>
Date: Wed, 7 May 2003 14:57:37 -0500
I found some similar problems back in October 02', the updated versions
should also fix the issues below. The vendor was notified and the
majority of the issues were fixed in the test release they provided back.
1) The SLMail application comes with an administrative web service that
allows the user to instantly gain SYSTEM privileges through a standard
directory traversal attack (you can launch executables). The wierd bit
about this is that you must use three dots to traverse the parent
directory, even on non Windows 9x systems (tested on Win2K).
GET /.../.../.../Winnt/system32/cmd.exe?/c+dir HTTP/1.0
Authorization: Basic <base64 auth>
Directory of C:\Winnt\system32
10/20/2002 07:12a <DIR> .
10/20/2002 07:12a <DIR> ..
09/17/2002 10:50a 350 $winnt$.inf
2) The SLMail admin server directory traversal  lets you check for the
existence of files without providing any authentication. The service is
returning a second HTTP header after the first that contains the actual
return code of the request (404, 501, 200, etc).
3) Overflow in the "LANGUAGE" parameter to all DLL's in the
/scripts/SLWebMail directory. I managed to finally get a second-chance
(fatal) exception after hitting it about 40 times with different length
4) Tons of path disclosure bugs. Set the LANGUAGE variable to something
invalid and it complains it cant find the error text file, giving up the
disk path in the process. This variable can be used with a directory
traversal, but you can only read files named 'ErrorText.dat'. Using a
null byte after the parameter does no good and overflowing it entirely
only lets you bleed into an adjacent buffer, which is then overwritten
with "C:\WINNT\x00" (from the SYSTEMPATH env actually). There are quite a
few other places where it spits out extraneous path information.
5) A couple GUI applications are installed in /scripts/SLWebMail/WebMail,
you can just keep requesting these one by one until the server runs out
of memory. I couldn't find any useful arguments to either of the apps
(signature.exe and BanWiz.exe). The BanWiz executable takes a file name
as the first parameter but does not actually do anything with it.
-- path disclosure
GET /Scripts/SLwebmail/God.dll?LANGUAGE=TONGUES HTTP/1.0
-- heap overflow
-- silly remote gui app launch
(possible overflow in query string, havent verified)
On Wednesday 07 May 2003, NGSSoftware Insight Security Research wrote:
SLWebMail is a web based e-mail system that runs on top of Microsoft's
Internet Information Server. It is vulnerable to many different kinds
of issues, such as buffer overflows, arbitrary file access and physical