[SA20707] WinGate IMAP Commands Directory Traversal Vulnerability

Type securityvulns
Reporter Securityvulns
Modified 2006-07-11T00:00:00


Hardcore Disassembler / Reverse Engineer

Reversing must be a passion as your skills will be challenged on a daily basis and you will be working several hours everyday in IDA, Ollydbg, and with BinDiff. Often, it is also required that you write a PoC or even a working exploit to prove that an issue is exploitable.


TITLE: WinGate IMAP Commands Directory Traversal Vulnerability


VERIFY ADVISORY: http://secunia.com/advisories/20707/

CRITICAL: Moderately critical

IMPACT: Security Bypass, Exposure of sensitive information

WHERE: >From remote

SOFTWARE: WinGate 6.x http://secunia.com/product/3651/

DESCRIPTION: Secunia Research has discovered a vulnerability in WinGate, which can be exploited by malicious users to disclose potentially sensitive information and bypass certain security restrictions.

The vulnerability is caused due to an input validation error in the IMAP service during handling of the "CREATE", "SELECT", "DELETE", "RENAME", "COPY", "APPEND", and "LIST" commands. This can be exploited by an authenticated user to read other users' emails, create/rename arbitrary directories on the system, and delete certain directories via directory traversal attacks.

The vulnerability has been confirmed in versions and Other versions may also be affected.

SOLUTION: Update to version 6.1.4 Build 1099 or later. http://www.wingate.com/download.php

PROVIDED AND/OR DISCOVERED BY: Tan Chew Keong, Secunia Research.

ORIGINAL ADVISORY: Secunia Research: http://secunia.com/secunia_research/2006-48/advisory/

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.