-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


TTG0602 - Alt-N WebAdmin MDaemon Account Hijacking

RELEASE DATE:
September 4, 2006

VENDOR:
Alt-N Technologies ( http://www.altn.com ) 

VULNERABLE:
Tested on Alt-N WebAdmin v3.2.5 running
with MDaemon v9.0.6, earlier versions are
suspected vulnerable as well

SEVERITY:
Domain administrators within the default domain
can take over the "MDaemon" system account, which
could lead to compromise of sensitive data

OS:
Microsoft Windows XP/2000/2003



SUMMARY

WebAdmin is a remote administration utility which allows administrators to
manage Alt-N's MDaemon, RelayFax and WorldClient products. Recently this
has become a standard module for the company's MDaemon mail server, altough
it remains available independently as well.

It is possible for a domain administrator within the default domain of a
MDaemon server to gain access to the server's "MDaemon" account through the
WebAdmin. This is the account which processes remote server and mailinglist
commands, which are authenticated by putting a user's email address and
password in the subject field of a message.

By taking over this account and enabling mail access to it a malicious
domain administrator could gain access to the system queue, the contents of
which are by default only stored on disk and not accessible.

It is important to note that this queue processes the messages for all
domains on the server, not just the local one.



DETAILS

Within the MDaemon structure, domain administrators are users which are
allowed to manage accounts for a specific domain on the server. While the
"MDaemon" account is not available or even visible for modification in the
WebAdmin interface, it's details can be accessed through sending a specially
constructed url to the useredit_account.wdm module.

Access to it's settings are still restricted when called in this way.
However,
it is possible to rename the mailbox to which this account directs it's
queue.
By now creating a new account with the details of original MDaemon account
and enabling mail access to it, the messages destined for the server account
can be read through a regular mail interface while they're stored until
processed.

This account will now also be recognized as the system account by the server
and the original MDaemon user, now just a regular account, can be deleted by
the domain administrator to cover his tracks.



IMPACT

The impact of this vulnerability in a small environment using only trusted
administrators is low. In larger environments were one to trust on WebAdmin's
user restrictions the impact of mentioned problems is larger, as they could
allow further compromise of accounts on any domain, not just the local one,
on the server.



FIX

WebAdmin v3.2.5 was released on August 18 in response to earlier reported
vulnerabilities(1). In testing, it was found that while previous issues were
fixed, this version still did not completely curtail access to the MDaemon
account for some users.

The vendor was notified of this on August 24th and WebAdmin v3.2.6(2) was
issued on August 30th. This update has been confirmed to fix this matter by
ourselves on September 1st and we waited until after the weekend to release
this to facilitate updating.



REFERENCES

(1) TTG0601 - Alt-N WebAdmin Multiple Vulnerabilities
http://www.teklow.com/advisories/TTG0601.txt 

(2) WebAdmin Server v3.2.6 Release Notes
http://files.altn.com/WebAdmin/Release/RelNotes_en.txt 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)

iD8DBQFE/If1XSyYXTPz6J0RAnUEAJ44uUgIr1Ocnl09wbPFx5ulZhVhxACeOi4g
ODlCA1WIwRNGnLg+d9LGZtU=Wame
-----END PGP SIGNATURE-----