IceWarp Multiple Script Remote File Inclusion

medium Nessus Plugin ID 22079

Synopsis

The remote web server contains a PHP application that is prone to remote file include attacks.

Description

The remote host is running IceWarp Web Mail, a webmail product written in PHP that is distributed as a standalone application and is also bundled with VisNetic Mail Server and Merak Mail Server.

The version of IceWarp Web Mail installed on the remote host fails to sanitize user-supplied input to the 'lang_settings' parameter of the 'accounts/inc/include.php' and 'admin/inc/include.php' scripts before using it to include PHP code. An unauthenticated attacker may be able to exploit these flaws to view arbitrary files on the remote host or to execute arbitrary PHP code, for example, after injecting it into the mail server's log file.

In addition, the /mail/settings.html script has been reported vulnerable to a traversal issue via the 'language' parameter. However, Nessus has not checked for this.

Solution

Upgrade to IceWarp Web Mail 5.6.1 / Merak Mail Server 8.3.8.r / VisNetic Mail Server 8.5.0.5 or later.

See Also

https://secuniaresearch.flexerasoftware.com/secunia_research/2006-12/advisory/

https://secuniaresearch.flexerasoftware.com/secunia_research/2006-14/advisory/

Plugin Details

Severity: Medium

ID: 22079

File Name: icewarp_lang_settings_file_includes.nasl

Version: 1.20

Type: remote

Family: CGI abuses

Published: 7/20/2006

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: cpe:/a:icewarp:webmail

Required KB Items: www/PHP

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Vulnerability Publication Date: 7/17/2006

Reference Information

CVE: CVE-2006-0817, CVE-2006-0818

BID: 19007, 19002