IlohaMail Insecure Configuration Files

wang_at_readyresponse.org
Date: 01/11/05

  • Next message: David Ahmad: "Fwd: APPLE-SA-2005-01-11 iTunes 4.7.1" 
    Date: 11 Jan 2005 01:47:55 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    ------------------------------------------------

    Advisory Name : IlohaMail Insecure Configuration Files
    Release Date : 10 January, 2004
    Application : IlohaMail (http://ilohamail.org/)
    Vulnerable: IlohaMail-0.8.14-rc1 and lower
    Not Vulnerable: IlohaMail-0.8.14-rc2

    Author : SRR Project Group of Ready Response (srr.readyresponse.org / www.readyresponse.org)

    ------------------------------------------------

    Description

    IlohaMail is a PHP based lightweight full featured multilingual webmail program with IMAP and POP3 support. If an administrator follows the "INSTALL" file steps to install IlohaMail they will end up with an insecure setup that could allow a remote visitor to the web site to download their configuration files and in some cases obtain username/password credentials for SMTP authentication (very useful to spammers).

    The problem exists primarily due to the use of the file extension ".inc" on a number of important configuration files, such as:
     
    conf/conf.inc
    conf/custom_auth.inc
    conf/login.inc

    The problem is made worse because the installation instructions do not correctly inform the end user of how to securely setup their IlohaMail. ".inc" is not a secure file extension to use, and therefore if the .inc configuration files are within the web root (a result of following the INSTALL file steps) they will be publicly accessible/readable via the URL:

    http://yourdomain.com/IlohaMail/conf/conf.inc
    etc

    This is dangerous as it can potentially reveal the following information to any remote visitor:

    * File paths to important directories (upload directories for mail attachments, session storage directories etc)

    * Authenticated SMTP credentials (highly valuable information to spammers)

    * Other useful information for potential attackers

    ------------------------------------------------
     
    Exploit
     
    No exploit is required to leverage this issue.
     

    ------------------------------------------------
     
    Solution / Vendor Response

    Our suggested fix to the IlohaMail team was to stop using the ".inc" file extension and instead use a more secure file extension such as ".inc.php" or ".php" for all include files.

    The IlohaMail team were contacted on 15/12/2004 and promptly replied + investigated this issue. We were informed on 23/12/2004 that the IlohaMail team would be fixing this issue in 0.9 and would be implementing a workaround for 0.8 releases.

    IlohaMail-0.8.14-rc2 was released on 01/01/2005 and has addressed this issue.

    We would like to thank IlohaMail for their fast response and professional attitude to security.

    ------------------------------------------------
     
    Credit
     
    Discovery of this issue is credited to the SRR project group of Ready Response - (srr.readyresponse.org / www.readyresponse.org)

  • Next message: David Ahmad: "Fwd: APPLE-SA-2005-01-11 iTunes 4.7.1"