mailing list archives
Comcast(tm) Email Manager allows arbitrary java and activex code execution
From: "Michael Scheidell" <scheidell () secnap net>
Date: Thu, 22 Jul 2004 11:36:07 -0400
Vulnerability in Comcast Webmail Manager allows arbitrary java and activex code execution
Systems: Comcast Webmail email system. www.comcast.net
Vulnerable: X-Mailer: AT&T Message Center Version 1 (Mar 22 2004)
Not Vulnerable: Unknown
Severity: Serious / Low (Fixed now)
Category: Arbitrary Execution of Code of Hackers Choice
Classification: Input Validation Error
Remote Exploit: yes
Local Exploit: no
Vendor URL: www.comcast.net
Author: Michael S. Scheidell, SECNAP Network Security
Original Release date: April 7, 2004
Notifications: Comcast notified April 7, 2004
Public Release date: July 22, 2004
Discussion: from www.comcast.com
High-Speed Internet. This is the fastest way to travel the Web! It's cable-powered, so it's always connected and you
won't tie up your phone lines. It's a faster, more powerful and more convenient Internet experience.
Note: This is not so much a warning to Comcast or their users, since Comcast has fixed this problem, but more of a
warning to every developer or CSIO to make sure that web based email, blogs, information, memos must check their code
to make sure it is safe. See additional notifications of similar problems with GoldMine(tm)
http://www.secnap.com/security/gm001.html, and sprintmail picture mail at http://www.secnap.com/security/030711.html
Problem: There was a potential for hackers to use this vulnerability to specially craft emails that will run random
code of their choice on users' computers - including remote Trojans, irc zombies, spyware, malware, and remote key
loggers. This program would run inside the corporate network, behind the firewall and access anything the infected user
has access to.
The Comcast Webmail did not run the html email in the 'security zone' as does Microsoft(tm) Outlook, but passed
anything that looks like HTML to be executed unrestricted directly to the default Browser (usually IE). Linux/or Unix
Comcast users have the option of using Comcast Webmail or Outlook Express. Because of the inability to disable
html/java/or active-x in Comcast Webmail, those using Webmail had an increased chance of their computers' becoming
an HTML e-mail message.
The above has been tested on a Windows(tm) 2000 system with service pack 4, all Internet Explorer patches and default
(factory) Internet zone security settings. Also tested were two Windows XP(tm) systems with service pack 1 and all
patches as well as Netscape 7.1 on Linux.
The security community first became aware of the potential for this kind of threat about two years ago. Software
companies that produce Web-based email, blog or input system must check for arbitrary java and html code. Note: the
original Web Mail system was written by AT&T and was inherited by Comcast during their purchase of AT&T's broadband
Exploit: No exploit is necessary, as there are already examples in viruses and trojans that were designed to attack
Microsoft Outlook and Outlook Express.
Microsoft fixed these by patching both readers and allowing the user to set the security zone for reading HTML email in
the 'insecure' settings.
To see an exhaustive list of what can happen when email is passed to IE, see <http://www.guninski.com/browsers.html>
Vendor Response: April 7, 2004. A Comcast representative called our office immediately. Comcast worked quickly on
fixing this bug and rolling it out to their servers, with a solution in place by April 13, 2004. Release of this
notification was held back waiting for Comcast to decide how and when to self-release.
Comcast is now filtering out various forms of scripting.
Michael Scheidell, SECNAP Network Security, www.secnap.com
The original problem with IIE, Microsoft Outlook and Outlook Express was found by George Grunski and involved insecure
default reading of a malformed HTML in Outlook and OE and insecure running of HTML (see
<http://www.guninski.com/browsers.html>) And thanks to Johannes B. Ullrich, CTO SANS Internet Storm Center for
Original copy of this report can be found here
Above Copyright(c) 2004, SECNAP Network Security Corporation. World rights reserved.
This security report can be copied and redistributed electronically provided it is not edited and is quoted in its
entirety without written consent of SECNAP Network Security Corporation. Additional information or permission may be
obtained by contacting SECNAP Network Security at 561-999-5000
Full-Disclosure - We believe in it.
- Comcast(tm) Email Manager allows arbitrary java and activex code execution Michael Scheidell (Jul 25)