Hardcore Disassembler / Reverse Engineer
Reversing must be a passion as your skills will be challenged on a daily basis and you will be working several hours everyday in IDA, Ollydbg, and with BinDiff. Often, it is also required that you write a PoC or even a working exploit to prove that an issue is exploitable.
TITLE: WinGate IMAP Commands Directory Traversal Vulnerability
SECUNIA ADVISORY ID: SA20707
VERIFY ADVISORY: http://secunia.com/advisories/20707/
CRITICAL: Moderately critical
IMPACT: Security Bypass, Exposure of sensitive information
WHERE: >From remote
SOFTWARE: WinGate 6.x http://secunia.com/product/3651/
DESCRIPTION: Secunia Research has discovered a vulnerability in WinGate, which can be exploited by malicious users to disclose potentially sensitive information and bypass certain security restrictions.
The vulnerability is caused due to an input validation error in the IMAP service during handling of the "CREATE", "SELECT", "DELETE", "RENAME", "COPY", "APPEND", and "LIST" commands. This can be exploited by an authenticated user to read other users' emails, create/rename arbitrary directories on the system, and delete certain directories via directory traversal attacks.
The vulnerability has been confirmed in versions 126.96.36.1994 and 188.8.131.526. Other versions may also be affected.
SOLUTION: Update to version 6.1.4 Build 1099 or later. http://www.wingate.com/download.php
PROVIDED AND/OR DISCOVERED BY: Tan Chew Keong, Secunia Research.
ORIGINAL ADVISORY: Secunia Research: http://secunia.com/secunia_research/2006-48/advisory/
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.