Recently, a vulnerability was discovered by Reed Arvin in the Mailtraq 2.6.1.1677 administration console. The vendor provided solution does not fully mitigate the privilege escalation vulnerability. You will find the original vulnerability advisory and the updated work around exploit information below. [Original Vulnerability Advisory] ------------------------------------------------------------- Summary: A privilege escalation flaw exists in Mailtraq Version 2.6.1.1677 (http://www.mailtraq.com/). Details: A privilege escalation technique can be used to gain SYSTEM level access while using the Mailtraq administration console. Vulnerable Versions: Mailtraq Version 2.6.1.1677. Solution: The vendor was notified. Vendor response: | This does not appear to be a security hole as the Mailtraq Console | is intended to be operated only by authorized administrators. The | console provides direct access to user data and the ability to | manipulate e-mail and other sensitive data for all users. For | this reason, in environments where non-administrators may be | granted physical access to the desktop we expect administrators | to secure the console by password protection. (This feature is | enabled in the Server Properties.) If the console is secured in | this manner, standard dialog functions such as that you described | are only available to administrators. Exploit: 1. Double click on the Mailtraq icon in the Taskbar 2. Right click in the right text pane and choose View Source 3. Notepad should open. Click File, click Open 4. In the Files of type: field choose All Files 5. Navagate to %WINDIR%\System32\ 6. Right click on cmd.exe and choose Open 7. A command prompt will launch with SYSTEM privileges Discovered by Reed Arvin reedarvin[at]gmail[dot]com -------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------- Additional Exploit Information (work around password protection): The vendor solution does not fully mitigate the privilege escalation vulnerability. The password protection mechanism successfully limits the access to the console, but a local user can perform the following steps to successfully escalate their privileges. The vendor has been notified of the vulnerability update. 1. Right click on the Mailtraq icon in the Taskbar 2. Select "About Mailtraq" 3. In the "Technical Support" section, click on "my.mailtraq.com" (or any other URL in the support window). This will open IE. (Assuming IE is the default browser setting for you). 4. Click File, click Open 5. Click Browse 6. Navigate to %WINDIR%\System32\ 7. Right click on cmd.exe and choose Open 8. A command prompt will launch with SYSTEM privileges Discovered by Travis Schack Travis[at]Vitalisec[dot]com