Title: IceWarp Universal WebMail Multiple Input Validation Vulnerabilities
Severity: HIGH
Description:
IceWarp Universal WebMail is a web-based interface to allow users to send and receive email messages using a third-party mail server. Deerfield VisNetic Mail Server and Merak Mail Server integrate IceWarp Universal WebMail into their suites.
IceWarp Universal WebMail is prone to multiple input-validation vulnerabilities:
- A remote file-include vulnerability occurs because the application fails to properly sanitize user-supplied input to the 'language' and 'lang_settings' parameters of the '/accounts/inc/include.php' and '/admin/inc/include.php' scripts.
- A remote file-include vulnerability occurs because the application fails to properly sanitize user-supplied input to the 'language' parameter of '/mail/settings.html'. Exploiting this issue along with an overwrite of the 'lang_settings' variable can allow an attacker to execute arbitrary remote and local PHP code.
- An information-disclosure issue occurs because the application fails to properly sanitize user-supplied input to the 'lang' parameter of '/dir/include.html'.
- An information-disclosure issue occurs because the application fails to properly initialize the 'default_layout' and 'layout_settings' variables when an unrecognized HTTP_USER_AGENT string is encountered by '/mail/include.html'. Exploiting this issue along with an overwrite of the 'default_layout' and 'layout_settings' variables can cause the server to disclose the contents of local files.
Merak Mail Server 8.3.0.r and VisNetic Mail Server 8.3.0 build 1 are affected by these issues.
UPDATE (July 30, 2007): Symantec has confirmed that this issue is being actively exploited in the wild.
Affected Products:
- Deerfield VisNetic Mail Server 8.3.0 .0 build 1
- Merak Mail Server 8.3.0 .0.r
References:
- Deerfield: VisNetic Mail Server Home Page
- Merak: Merak Mail Server Home Page
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
