Info

Disclosure

Jan 27, 2005

Discovery

Jan 15, 2005

Dates

Exploit

Unknown

Solution

Unknown

Description

Winmail Server contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate user-supplied input in certain fields upon submission to the 'user.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Classification

Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Unknown
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Upgrade to version 4.0 (Build 1318) or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

AMAX Information Technologies Inc.

Winmail Server

4.0 (Build 1112)

References

Security Tracker: 1013017
Bugtraq ID: 12388
Related OSVDB ID: 13244 13245 13247 13248
Secunia Advisory ID: 14053
CVE ID: 2005-0314 (see also: NVD)
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-01/0306.html
Other Advisory URL: http://www.security.org.sg/vuln/magicwinmail40.html

Credit

Tan Chew Keong - vulnsecunia.com - Secunia Research

Direct URL: http://osvdb.org/36218