JVN#00344155: Multiple vulnerabilities in Denbun

Denbun provided by NEOJAPAN Inc. is a WebMail System. Denbun contains multiple vulnerabilities listed below.

Hard-coded credentials for user account (CWE-798) - CVE-2018-0680

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Base Score: 9.8
CVSS v2	AV:N/AC:L/Au:N/C:P/I:P/A:P	Base Score: 7.5

Hard-coded credentials for the configuration management page (CWE-798) - CVE-2018-0681

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Base Score: 9.8
CVSS v2	AV:N/AC:L/Au:N/C:P/I:P/A:P	Base Score: 7.5

Improper session management (CWE-639) - CVE-2018-0682

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	Base Score: 4.8
CVSS v2	AV:N/AC:H/Au:N/C:P/I:P/A:N	Base Score: 4.0

Stack-based buffer overflow due to a flaw in processing Cookie data (CWE-121) - CVE-2018-0683

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Base Score: 9.8
CVSS v2	AV:N/AC:L/Au:N/C:P/I:P/A:P	Base Score: 7.5

Stack-based buffer overflow due to a flaw in processing multipart/form-data format data (CWE-121) - CVE-2018-0684

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Base Score: 9.8
CVSS v2	AV:N/AC:L/Au:N/C:P/I:P/A:P	Base Score: 7.5

SQL injection due to a flaw in processing HTTP requests for mail search (CWE-89) - CVE-2018-0685

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	Base Score: 6.3
CVSS v2	AV:N/AC:L/Au:S/C:P/I:P/A:P	Base Score: 6.5

Arbitrary executable files can be uploaded (CWE-434) - CVE-2018-0686

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Base Score: 8.8
CVSS v2	AV:N/AC:L/Au:S/C:P/I:P/A:P	Base Score: 6.5

Cross-site scripting in HTML mail view (CWE-79) - CVE-2018-0687

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	Base Score: 6.1
CVSS v2	AV:N/AC:M/Au:N/C:N/I:P/A:N	Base Score: 4.3

Impact

• A remote attacker may read and/or send mail, may change the configuration. - CVE-2018-0680, CVE-2018-0682
• A remote attacker may log in to the Management page and modify the mail server configuration. - CVE-2018-0681
• A remote attacker may be able to execute arbitrary code or cause a denial-of-service (DoS) condition. - CVE-2018-0683, CVE-2018-0684
• A logged in user may execute arbitrary SQL statements. - CVE-2018-0685
• A logged in user may upload and execute any executable files. - CVE-2018-0686
• An arbitrary script may be executed on a logged in user’s web browser. - CVE-2018-0687

Solution

Update the Software- CVE-2018-0680, CVE-2018-0681, CVE-2018-0682, CVE-2018-0683, CVE-2018-0684, CVE-2018-0685, CVE-2018-0687
Update to the latest version according to the information provided by the developer.

Apply Workaround- CVE-2018-0686

• Configure the web server to restrict execution of uploaded files
  For more information, refer to the information provided by the developer.

Products Affected

CVE-2018-0680, CVE-2018-0681, CVE-2018-0682, CVE-2018-0683, CVE-2018-0686, CVE-2018-0687

• Denbun POP version V3.3P R4.0 and earlier

• Denbun IMAP version V3.3I R4.0 and earlier
  CVE-2018-0684

• Denbun POP version V3.3P R3.0 and earlier

• Denbun IMAP version V3.3I R3.0 and earlier
  CVE-2018-0685

• Denbun POP version V3.3P R4.0 and earlier