Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2003.0352 -- NGSSoftware Insight Security Research Advisory
Multiple Vulnerabilities in SLWebMail
08 May 2003
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: SLWebMail 3
Publisher: NGSSoftware
Operating System: Windows
Impact: Execute Arbitrary Code/Commands
Denial of Service
Read-only Data Access
Reduced Security
Access Required: Remote
CVE Names: CAN-2003-0266, CAN-2003-0267, CAN-2003-0268
- --------------------------BEGIN INCLUDED TEXT--------------------
NGSSoftware Insight Security Research Advisory
Name: Multiple Vulnerabilities in SLWebMail
Systems Affected: SLWebMail 3 on Windows
Severity: High Risk
Vendor URL: http://www.slmail.com
Authors: David Litchfield (david@ngssoftware.com)
Mark Litchfield (mark@ngssoftware.com)
Date: 7th May 2003
Advisory URL: http://www.nextgenss.com/advisories/slwebmail-vulns.txt
Advisory number: #NISR07052003B
Description
***********
SLWebMail is a web based e-mail system that runs on top of Microsoft's
Internet Information Server. It is vulnerable to many different kinds of
issues, such as buffer overflows, arbitrary file access and physical path
revelation.
Details
*******
Buffer Overflows
****************
Many of the ISAPI DLL applications that form SLWebmail are vulnerable to
buffer overflow vulnerabilities. By passsing an overly long value for
certain parameters in the query string the overflows can be triggered.
Module: showlogin.dll
Parameter: Language
Module: recman.dll
Parameter: CompanyID
Module: admin.dll
Parameter: CompanyID
Module: globallogin.dll
Parameter: CompanyID
Abritrary File Access
*********************
ShowGodLog.dll can be accessed without requiring a remote user to
authenticate. This ISAPI application is used to show SLWebMail's log file.
However, by providing the path, relative or full, to any file that the
anonymous Internet account has read access to then access to the contents
can be gained, even outside of the web root.
Physical Path Revelation
************************
By making invalid requests to certain DLLs such as WebMailReq.dll the
complete physical path to the DLL is revealed. This information can be used
to help with other attacks.
Fix Information
***************
NGSSoftware alerted SLMail to these issues in February and an update has
been released. See http://www.slmail.com for more details.
A check for these issues has been added to Typhon, a comprehensive automated
vulnerability assessment tool of which more information is available from
the NGSSite: http://www.ngssoftware.com/
About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware have
offices in the South of London and the East Coast of Scotland. NGSSoftware's
sister company NGSConsulting, offers best of breed security consulting
services, specialising in application, host and network security
assessments.
http://www.ngssoftware.com/
http://www.ngsconsulting.com/
Telephone +44 208 401 0070
Fax +44 208 401 0076
enquiries@ngssoftware.com
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business
hours which are GMT+10:00 (AEST). On call after hours
for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBPrqdUSh9+71yA2DNAQEQUgP9Etg+YZhFfUaFZG0QIDQXHCqRpq7ZscIs
Mr8bkhrcwlO2088jjWcacUjmb4cFzT4D6ykibdVPUxkHcqudefpuh1GBs/LR7YBH
TtR+i6EWt3qp0OLS/CWCUyXseIOFjWt4AWLF92Xtc6wJs1ZYpdZDH5kVx5dYd/PK
MFlKi2xZNYI=
=xEAq
-----END PGP SIGNATURE-----