===================================================================== CERT-Renater Note d'Information No. 2005/VULN328 _____________________________________________________________________ DATE : 25/05/2005 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running Ipswitch IMail. ====================================================================== Ipswitch IMail IMAP STATUS Remote Buffer Overflow Vulnerability iDEFENSE Security Advisory 05.24.05 www.idefense.com/application/poi/display?id=244&type=vulnerabilities May 24, 2005 I. BACKGROUND Ipswitch Collaboration Suite (ICS) is a comprehensive communication and collaboration solution for Microsoft Windows with a customer base of over 53 million users. More information is available on the vendor's website: http://www.ipswitch.com/products/IMail_Server/index.html II. DESCRIPTION Remote exploitation of a buffer overflow vulnerability in Ipswitch Inc.'s Imail IMAP server allows attackers to execute arbitrary code with System privileges. The vulnerability specifically exists in the handling of a long mailbox name to the STATUS command. A long mailbox name argument will cause a stack based buffer overflow, providing the attacker with full control over the saved return address on the stack. Once this has been achieved, execution of arbitrary code becomes trivial. As this vulnerability is in the STATUS command, which requires that a session is authenticated, valid credentials are required. III. ANALYSIS Successful exploitation allows remote attackers to execute arbitrary code with System privileges. Valid credentials are required for exploitation, which lessens the impact of this vulnerability. IV. DETECTION iDEFENSE has confirmed the existence of this vulnerability in Ipswitch IMail version 8.13. It is suspected that earlier versions are also vulnerable. V. WORKAROUND As this vulnerability is exploited after authentication occurs, ensuring that only trusted users have accounts can mitigate the risk somwhat. As a more effective workaround, consider limiting access to the IMAP server by filtering TCP port 143. If possible, consider disabling IMAP and forcing users to use POP3. VI. VENDOR RESPONSE The vendor has released the following patch to fix this vulnerability: ftp://ftp.ipswitch.com/Ipswitch/Product_Support/IMail/imail82hf2.exe The associated vendor advisory can be found at: http://www.ipswitch.com/support/imail/releases/imail_professional/im82hf 2.html VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2005-1256 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 04/25/2005 Initial vendor notification 05/10/2005 Initial vendor response 05/24/2005 Public disclosure IX. CREDIT iDEFENSE Labs is credited with this discovery. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp Free tools, research and upcoming events http://labs.idefense.com X. LEGAL NOTICES Copyright (c) 2005 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@idefense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. ======================================== Ipswitch IMail IMAP LSUB DoS Vulnerability iDEFENSE Security Advisory 05.24.05 www.idefense.com/application/poi/display?id=245&type=vulnerabilities May 24, 2005 I. BACKGROUND Ipswitch Collaboration Suite (ICS) is a comprehensive communication and collaboration solution for Microsoft Windows with a customer base of over 53 million users. More information is available on the vendor's website: http://www.ipswitch.com/products/IMail_Server/index.html II. DESCRIPTION Remote exploitation of a denial of service (DoS) vulnerability in Ipswitch Inc.'s IMail IMAP daemon allows attackers to cause 100 percent CPU use on the server, thereby preventing legitimate users from retrieving e-mail. The problem specifically exists within IMAPD32.EXE upon parsing a malformed LSUB command. An attacker can cause the daemon to produce heavy load by transmitting a long string of NULL characters to the 'LSUB' IMAP directive. This, in turn, causes an infinite loop, eventually exhausting all available system resources and causing a denial of service. III. ANALYSIS Exploitation allows unauthenticated remote attackers to render the IMAP server useless, thereby preventing legitimate users from retrieving e- mail. This attack takes few resources to launch and can be repeated to ensure that an unpatched system is unable to recover. Exploitation requires a valid IMAP account, thus limiting the impact of this vulnerability. IV. DETECTION iDEFENSE has confirmed the existence of this vulnerability in Ipswitch IMail version 8.13. It is suspected that earlier versions are also vulnerable. V. WORKAROUND As this vulnerability is exploited after authentication occurs, ensuring that only trusted users have accounts can mitigate the risk somwhat. As a more effective workaround, consider limiting access to the IMAP server by filtering TCP port 143. If possible, consider disabling IMAP and forcing users to use POP3. VI. VENDOR RESPONSE The vendor has released the following patch to fix this vulnerability: ftp://ftp.ipswitch.com/Ipswitch/Product_Support/IMail/imail82hf2.exe The associated vendor advisory can be found at: http://www.ipswitch.com/support/imail/releases/imail_professional/im82hf 2.html VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2005-1249 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 04/25/2005 Initial vendor notification 05/10/2005 Initial vendor response 05/24/2005 Public disclosure IX. CREDIT The discoverer of the first vulnerability wishes to remain anonymous. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp Free tools, research and upcoming events http://labs.idefense.com X. LEGAL NOTICES Copyright (c) 2005 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@idefense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. ======================================== Ipswitch IMail IMAP LOGIN Remote Buffer Overflow Vulnerabilities iDEFENSE Security Advisory 05.24.05 www.idefense.com/application/poi/display?id=243&type=vulnerabilities May 24, 2005 I. BACKGROUND Ipswitch Collaboration Suite (ICS) is a comprehensive communication and collaboration solution for Microsoft Windows with a customer base of over 53 million users. More information is available on the vendor's website: http://www.ipswitch.com/products/IMail_Server/index.html II. DESCRIPTION Remote exploitation of several buffer overflow vulnerabilities in Ipswitch Inc.'s Imail IMAP server allows attackers to execute arbitrary code with System privileges. The first vulnerability specifically exists in the handling of a long username to the LOGIN command. A long username argument of approximately 2,000 bytes will cause a stack based unicode string buffer overflow providing the attacker with partial control over EIP. As this vulnerability is in the LOGIN command itself, valid credentials are not required. The second vulnerability also exists in the handling of the LOGIN command username argument, however it lends itself to easier exploitation. If a large username starting with one of several special characters is specified, a stack overflow occurs, allowing an attacker to overwrite the saved instruction pointer and control execution flow. Included in the list of special characters are the following: % : * @ & Both of these vulnerabilities can lead to the execution of arbitrary code. III. ANALYSIS Successful exploitation allows remote attackers to execute arbitrary code with System privileges. Valid credentials are not required to for exploitation, which heightens the impact of this vulnerability. IV. DETECTION iDEFENSE has confirmed the existence of this vulnerability in the latest version of Ipswitch IMAIL, version 8.13. Version 8.12 is also confirmed as vulnerable. It is suspected that earlier versions are also vulnerable. V. WORKAROUND As this vulnerability is exploited before authentication occurs, the only effective workaround is to limit access to the IMAP server by filtering TCP port 143. If possible, consider disabling IMAP and forcing users to use POP3. VI. VENDOR RESPONSE The vendor has released the following patch to fix this vulnerability: ftp://ftp.ipswitch.com/Ipswitch/Product_Support/IMail/imail82hf2.exe The associated vendor advisory can be found at: http://www.ipswitch.com/support/imail/releases/imail_professional/im82hf 2.html VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2005-1255 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 04/25/2005 Initial vendor notification 05/10/2005 Initial vendor response 05/24/2005 Public disclosure IX. CREDIT The discoverer of the first vulnerability wishes to remain anonymous. iDEFENSE Labs is credited with the discovery of the second vulnerability. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp Free tools, research and upcoming events http://labs.idefense.com X. LEGAL NOTICES Copyright (c) 2005 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@idefense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. ======================================== Ipswitch IMail Web Calendaring Arbitrary File Read Vulnerability iDEFENSE Security Advisory 05.24.05 www.idefense.com/application/poi/display?id=242&type=vulnerabilities May 24, 2005 I. BACKGROUND Ipswitch Collaboration Suite (ICS) is a comprehensive communication and collaboration solution for Microsoft Windows with a customer base of over 53 million users. More information is available on the vendor's website: http://www.ipswitch.com/products/IMail_Server/index.html II. DESCRIPTION Remote exploitation of a directory traversal vulnerability in Ipswitch Inc.'s Imail Web Calendaring server allows attackers to read arbitrary files with System privileges. The problem specifically exists because of a flaw in the handling of requests for nonexistent javascript (jsp) files. By requesting a nonexistent jsp file followed by a question mark, several sequences of "..\" and then the path to a file on the system, an attacker can read arbitrary files remotely without any authentication. The following query demonstrates how the system's boot.ini file may be retrieved: GET /bla.jsp?\..\..\..\..\..\..\..\..\..\..\boot.ini HTTP/1.0 Connection: Close Host: example.com User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Pragma: no-cache III. ANALYSIS Successful exploitation allows remote attackers to retrieve arbitrary files from the target host. Exploitation does not require authentication and does not require exploit code, as a user can simply type the malicious query in a web browser. IV. DETECTION iDEFENSE has confirmed the existence of this vulnerability in the latest version of Ipswitch IMAIL, version 8.13. It is suspected that earlier versions are also vulnerable. V. WORKAROUND Limit access to the Web Calandaring server by allowing only trusted hosts to access TCP port 8484, the default port for Web Calandaring. If the Web Calandaring service is not required, disable it entirely. VI. VENDOR RESPONSE The vendor has released the following patch to fix this vulnerability: ftp://ftp.ipswitch.com/Ipswitch/Product_Support/IMail/imail82hf2.exe The associated vendor advisory can be found at: http://www.ipswitch.com/support/imail/releases/imail_professional/im82hf 2.html VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2005-1252 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 04/25/2005 Initial vendor notification 05/10/2005 Initial vendor response 05/24/2005 Public disclosure IX. CREDIT The discoverer of this vulnerability wishes to remain anonymous. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp Free tools, research and upcoming events http://labs.idefense.com X. LEGAL NOTICES Copyright (c) 2005 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@idefense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. ======================================== Ipswitch IMail IMAP SELECT Command DoS Vulnerability iDEFENSE Security Advisory 05.24.05 www.idefense.com/application/poi/display?id=241&type=vulnerabilities May 24, 2005 I. BACKGROUND Ipswitch IMail server is a Windows based messaging solution with a customer base of over 53 million users. More information about the application is available at: http://www.ipswitch.com/products/IMail_Server/index.html. II. DESCRIPTION Remote exploitation of a denial of service vulnerability in Ipswitch Inc.'s Imail IMAP server allows attackers to crash the target service thereby preventing legitimate usage. The problem specifically exists in the handling of long arguments to the SELECT command. When a string approximately 260 bytes in size is supplied a stack-based buffer overflow occurs that results in an unhandled access violation forcing the daemon to exit. The issue is not believed to be further exploitable. III. ANALYSIS Successful exploitation allows remote to crash vulnerable IMAP servers and thereby prevent legitimate usage. The SELECT command is only available post authentication and therefore valid credentials are required to exploit this vulnerability IV. DETECTION iDEFENSE has confirmed the existence of this vulnerability in the latest version of Ipswitch IMAIL, version 8.13. Version 8.12 is also confirmed as vulnerable. It is suspected that earlier versions are vulnerable as well. V. WORKAROUND As this vulnerability is exploited after authentication occurs, ensuring that only trusted users have accounts can mitigate the risk somwhat. As a more effective workaround, consider limiting access to the IMAP server by filtering TCP port 143. If possible, consider disabling IMAP and forcing users to use POP3. VI. VENDOR RESPONSE The vendor has released the following patch to fix this vulnerability: ftp://ftp.ipswitch.com/Ipswitch/Product_Support/IMail/imail82hf2.exe The associated vendor advisory can be found at: http://www.ipswitch.com/support/imail/releases/imail_professional/im82hf 2.html VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2005-1254 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 04/15/2005 Initial vendor notification 05/10/2005 Initial vendor response 05/24/2005 Coordinated public disclosure IX. CREDIT Sebastian Apelt is credited with this discovery. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp Free tools, research and upcoming events http://labs.idefense.com X. LEGAL NOTICES Copyright (c) 2005 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@idefense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================