Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: Apps :: bt915.txt

Omail Webmail 0.98.4 remote command exec CGI:







Product: Omail Webmail

Author:  Olivier Mueller

Vulnerable Versions: 

	- 0.98.x

	- 0.97.x

	- ...





    Omail is a Webmail coded in perl for qmail,

optionally with vmailmgr

or vpopmail.



   There is a security flaw in Omail which, if

installed by default, allows 

for remote root access. The minimum risk is exposure of

sensitive information

(all email accessible to omail), as well as remote

execution of commands as

a non-privileged user.



The flaw occurs in the function checklogin();



.........



omail.pl, line 689:



    my $command = 'echo -e "'. $domainname .'\000'. 

$username .'\000'.$password .'\000" | ' .$vauthenticate;

    my $output = `$command`;



.........





Prior to calling this line, the variables

$domainname,$username, and

$password are not filtered for shell metacharacters,

which results in the 

possibility of the execution of arbritrary commands.





The patch in itself is quite simple:





--- omail-webmail-0.98.4/omail-old.pl   2001-08-26

08:35:27.000000000 -0400

+++ omail-webmail-0.98.4/omail.pl       2003-07-28

12:29:36.000000000 -0400

@@ -396,7 +396,7 @@



   if (($vmailmgr || $vpopmail) && $cgi_mode eq "suid") {



-    if (!($userid =~ /(.*)\@(.*)/)) {

+    if (!($userid =~ /([A-Z,a-z,0-9]*)\@([\w\.]*)$/)) {

       omailerror("domain name is missing : format

userid\@domain");

     } else {

       $userid = $1;

@@ -406,7 +406,7 @@





   my $password = param("password");

-  $password =~ /^(.+)$/;

+  $password =~ /^([^\"]+)$/;

   $password = $1;



   # 8 possible cases :







The author was contacted two weeks ago, but did not

respond.



----------------------------------------------------

Phillip Whelan - Security Consultant

BunkerChile S.A. - Network Security Consulting Group

homepage: http://www.bunkerchile.net

email: info@bunkerchile.net

----------------------------------------------------



TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH