Re: Ipswitch's IMail Server POP3 Daemon Discloses Information on Username Validity to Remote Users and Lets Valid Remote Users Change Account Names of Other Users
|
|
SecurityTracker Alert ID: 1002538 |
|
SecurityTracker URL: http://securitytracker.com/id/1002538
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Oct 12 2001
|
Impact:
Denial of service via network, Disclosure of system information, Modification of user information
|
|
Version(s): 6.02, 6.06, and 7.04
|
Description:
A vulnerability was reported by ntsecurity.nu in the Ipswitch IMail Server. The POP3 server provides an indication to remote users as to whether a username is valid or not. The web messaging interface allows valid and authenticated remote users to change other users' account names.
A user reports that some additional versions are vulnerable (IMail 6.06 5-1 and IMail 6.02 35405-2) and that the problem still continues after patching (IM606hf5.exe) IMail 6.06.
For details on the vulnerability, see the Message History.
|
Impact:
A remote user can determine whether a particular account name exists on the server. A valid and authenticated remote user can change any other user's accountname, providing a denial of service condition.
|
Solution:
The vendor has reportedly made a patch available at the Vendor URL.
|
Vendor URL: www.ipswitch.com/support/IMail/patch-upgrades.html (Links to External Site)
|
Cause:
Authentication error, Input validation error, State error
|
Underlying OS:
Windows (NT), Windows (2000)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Fri, 12 Oct 2001 00:32:12 +0300
Subject: Re: Vulnerabilities in Ipswitch IMail Server 7.04
|
problem still continues after patching (IM606hf5.exe) imail 6.06 .
IMail 6.06 5-1
and
IMail 6.02 35405-2
is also vulnerable.
regards,
Ertan Kurt
Olympos Security
www.olympos.org
Thursday, October 11, 2001, 11:01:26 PM, "Arne Vidstrom"
<arne.vidstrom@ntsecurity.nu> wrote:
AV> Hi all,
AV> There are a couple of vulnerabilities in Ipswitch IMail Server 7.04.
**snip**
|
|
