SurgeMail surgeweb Account Access Security Restriction Bypass Vulnerability

Release date:
Updated on:

Affected Systems:
NetWin SurgeMail <6.5b
Description:
--------------------------------------------------------------------------------
SurgeMail is a mail server that runs on Windows NT/2 K or UNIX platforms and supports all the Standard IMAP, POP3, SMTP, SSL, and ESMTP protocols.

SurgeMail versions earlier than 6.5b allow other accounts to be accessed when multiple accounts are used, which can lead to logon to other user accounts. Multiple accounts are required to successfully exploit this vulnerability.

<* Source: vendor

Link: http://secunia.com/advisories/54927/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

NetWin
------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.netwinsite.com/surgemail/help/updates.htm