Visnetic Mail Server, Merak Mail Server and IceWarp Web Mail "language" parameter file include
| visnetic-language-file-include (27780) |  Medium Risk |
Description:
Visnetic Mail Server, Merak Mail Server and IceWarp Web Mail could allow a remote attacker to include arbitrary files. A remote attacker with valid authentication credentials could send a specially-crafted URL request to the /mail/settings.html script using the 'language' parameter to specify a malicious file from the local system, which could allow the attacker to obtain sensitive information or execute arbitrary code on the vulnerable system.
Note: In order to exploit this vulnerability to execute arbitrary code, the attacker would first be required to upload a malicious file or inject arbitrary commands into an existing file.
*CVSS:
| Base Score: | 2.1 |
| Access Vector: | Remote |
| Access Complexity: | Low |
| Authentication: | Required |
| Confidentiality Impact: | None |
| Integrity Impact: | Partial |
| Availability Impact: | None |
| Temporal Score: | 1.6 |
| Exploitability: | Unproven |
| Remediation Level: | Official-Fix |
| Report Confidence: | Confirmed |
Consequences:
Gain Access
Remedy:
For Visnetic Mail Server:
Upgrade to the latest version of Visnetic Mail Server (8.5.0.5 or later), available from the Visnetic Mail Server Web site. See References.
For Merak Mail Server:
Upgrade to the latest version of MERAK Mail Server (8.3.8.r or later), available from the Merak Mail Server Web site. See References.
For IceWarp Web Mail:
Upgrade to the latest verion of IceWarp Web Mail (5.6.1 or later), available from the IceWarp Web Mail Web site. See References.
References:
- IceWarp Web site: Merak Email Server by IceWarp.
- Visnetic Mail Server Web site: VisNetic Mail Server is a versatile, multi-featured mail server.
- BID-19002: VisNetic Mail Server Multiple File Include Vulnerabilities
- BID-19007: IceWarp Web Mail Multiple File Include Vulnerabilities
- CVE-2006-0818: Absolute path directory traversal vulnerability in (1) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (2) VisNetic MailServer before 8.5.0.5 allows remote authenticated users to include arbitrary files via a modified language parameter and a full Windows or UNC pathname in the lang_settings parameter to mail/index.html, which is not properly sanitized by the validatefolder PHP function, possibly due to an incomplete fix for CVE-2005-4558.
- SA18953: IceWarp Web Mail Two File Inclusion Vulnerabilities
- SA18966: VisNetic Mail Server Two File Inclusion Vulnerabilities
- SECTRACK ID: 1016513: IceWarp Web Mail Include File Bug in `language` and Other Parameters Lets Remote Users Execute Arbitrary Code
- SECTRACK ID: 1016514: VisNetic MailServer Include File Bug in `language` and Other Parameters Lets Remote Users Execute Arbitrary Code
- VUPEN/ADV-2006-2825: VisNetic Mail Server Multiple Parameter Handling Remote File Inclusion Vulnerabilities
- VUPEN/ADV-2006-2826: IceWarp Web Mail Multiple Parameter Handling Remote PHP File Inclusion Vulnerabilities
Platforms Affected:
- Deerfield.com VisNetic Mail Server 8.3.5
- IceWarp Software IceWarp Web Mail 5.6.0
- IceWarp Software Merak Mail Server 8.3.8.r
Reported:
Jul 18, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net
* According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall IBM be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.