[NEWS] JavaMail Directory Traversal Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 04/17/05

  • Next message: SecuriTeam: "[NT] Multiple Vulnerabilities in Internet Explorer (Heap Corruption, Race Condition)" 
    To: list@securiteam.com
Date: 17 Apr 2005 17:06:20 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      JavaMail Directory Traversal Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

    The JavaMail API provides a platform-independent and protocol-independent
    framework to build mail and messaging applications. The JavaMail API is
    implemented as a Java platform optional package and is also available as
    part of the Java 2 platform, Enterprise Edition.

    The JavaMail API doesn't properly validate filename attribute in
    Content-Disposition header, making it vulnerable to directory traversal
    attacks. Successful exploitation of this vulnerability allows writing
    arbitrary content in any directory accessible to the servlet running
    JavaMail.

    DETAILS

    Vulnerable Systems:
     * JavaMail version 1.3.2

    MimeBodyPart.getFileName () method in the JavaMail API get the filename
    associated with body part, if possible. The body part represents an
    "attachment" that was loaded from a file. While in the documentation of
    the function claims that the file name does not need to include path of
    directory, it doesn't properly filter file name attribute in
    Content-Disposition header, and it is possible to place a directory path
    with the file name.

    In order to exploit the problem, send an email with the following filename
    attribute in Content-Disposition header:
    ./../../file.ext

    This will write attachment three directories backward from expected
    location, as long as the servlet processing the email has writable access
    to that directory.

    Example:
    This method uses getFileName () method to save the first attachment into a
    file:

    protected void saveMailAttachment (javax.mail.internet.MimeMultipart mp) {
     try {
       int n = mp.getCount();
       javax.mail.Part p = mp.getBodyPart (0);
       String disposition = p.getDisposition ();
     
       if (disposition != null && (disposition.equalsIgnoreCase
    (javax.mail.Part.ATTACHMENT) || disposition.equalsIgnoreCase
    (javax.mail.Part.INLINE) ) ) {
          String filename = p.getFileName ();
          File f = new File (filename);
          OutputStream os = new BufferedOutputStream (new FileOutputStream (f)
    );
          InputStream is = p.getInputStream ();
          int c;
          while ( (c = is.read () ) != -1) os.write (c);
          os.close ();
       }
     } catch (Exception e) { }
    }

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:smcsoc@yahoo.es> Rafael San
    Miguel Carrasco .

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Multiple Vulnerabilities in Internet Explorer (Heap Corruption, Race Condition)"

    Relevant Pages

    • [NT] Fastream NETFile FTP/Web Server Directory Traversal
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Server is "a secure FTP server and Web server combined together in one ... directories outside the FTP root. ... The problem lies in the insufficient filtering of the filename input ...
      (Securiteam)
    • [UNIX] phpBB Attachment Mod Directory Traversal HTTP POST Injection
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Due to insufficient sanitizing of the filename in the attachment mod user ...
      (Securiteam)
    • [TOOL] DISE - Distributed Idle Scanning Engine
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... through the use of compliant machines stored in filename. ... Required Flags: ...
      (Securiteam)
    • [NT] Cygwin Buffer Overflow in Filename Length Check
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Cygwin Buffer Overflow in Filename Length Check ... $ gdb /usr/bin/touch.exe ...
      (Securiteam)
    • [REVS] 0x00 vs ASP File Upload Scripts
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... ASP, but as with other languages the NULL byte can cause problems when ASP ... does not store it in the filename variable. ...
      (Securiteam)