[28498] in bugtraq
Re: Directory traversal bug in Communigate Pro 4's Webmail
daemon@ATHENA.MIT.EDU (Albert Bendicho)
Mon Jan 20 23:44:10 2003
Message-Id: <5.2.0.9.1.20030107230015.02d028b0@pop.iddeo.es>
Date: Tue, 07 Jan 2003 23:10:29 +0000
To: "G.P.de.Boer" <g.p.de.boer@st.hanze.nl>, bugtraq@securityfocus.com
From: Albert Bendicho <bendi@redestb.es>
In-Reply-To: <1041885665.1978.13.camel@edinburgh>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Confirmed also with version 4.0 on Linux/Intel.
It also works on HTTP, no need of HTTPS
Albert Bendicho
At 21:41 06/01/2003 +0100, G.P.de.Boer wrote:
>Directory traversal bug in Communigate Pro 4.0b to 4.0.2
>--------------------------------------------------------
>
>
>Overview
>--------
>
>When experimenting a bit with Communigate Pro's webmail service I found
>a directory traversal bug by which attackers can read any file readable
>by the user Communigate runs as, defaultly root, not chrooted. I have
>only tested this on the FreeBSD version. Builds for other platforms are
>most probably vulnerable too.
>
>
>
>Exploitation
>------------
>
>Telnet to the port Communigate Pro's webmail service is listening on or
>establish a SSL-session and issue a request like: (mind the "//")
>
>GET /DomainFiles/*//../../../../etc/passwd HTTP/1.0
>
>Communigate will send the passwd file. Ofcourse the number of ".."'s
>depends on your installation.
>
>
>Fix
>---
>
>Upgrade to Communigate Pro 4.0.3, available on www.stalker.com.
>
>
>
>Other considerations
>--------------------
>
>You might want to run Communigate Pro as a non-root user, if you're not
>doing so already. Read the following link for more information about
>dropping root:
>http://www.stalker.com/CommuniGatePro/SysAdmin.html#Root
>
>
>Thanks
>------
>
>Thanks go out to Stalker Software for their quick and adequate response,
>a reply within a few minutes and a fix within 24 hours, bravo!
