----------------------------------------------------------------------

Want to work within IT-Security?

Secunia is expanding its team of highly skilled security experts.
We will help with relocation and obtaining a work permit.

Currently the following type of positions are available:
http://secunia.com/quality_assurance_analyst/
http://secunia.com/web_application_security_specialist/ 
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

----------------------------------------------------------------------

TITLE:
Neon WebMail for Java Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA22029

VERIFY ADVISORY:
http://secunia.com/advisories/22029/

CRITICAL:
Highly critical

IMPACT:
Cross Site Scripting, Manipulation of data, Exposure of sensitive
information, System access

WHERE:
>From remote

SOFTWARE:
Neon WebMail for Java 5.x
http://secunia.com/product/12061/

DESCRIPTION:
Tan Chew Keong has reported some vulnerabilities in Neon WebMail for
Java, which can be exploited by malicious users to manipulate and
disclose sensitive information, and conduct script insertion and SQL
injection attacks, and by malicious people to compromise a vulnerable
system.

1) An error caused due to e-mail attachments being stored insecurely
inside the web root in a predictable location can be exploited to
execute arbitrary JSP code via a malicious JSP file attachment.

Successful exploitation requires a valid user account or that a user
is tricked into opening a malicious e-mail.

2) An error in the "updatemail" servlet where the user ID is not
properly verified can be exploited by an authenticated user to move
other users' e-mails.

Example:
http://[host]/updatemail?ID=[userID]&getpost=get&folderid=-1&tofolderid=-9&status=1&execute=move

3) Input passed to the "adr_sortkey" and "adr_sortkey_desc"
parameters in "addrlist", and the "sortkey" and "sortkey_desc"
parameters in "maillist" isn't properly sanitised before being used
in a SQL query. This can be exploited to manipulate SQL queries by
injecting arbitrary SQL code.

Successful exploitation requires that the user has been
authenticated.

4) An error in the "updateuser" servlet where the "in_id" parameter
is not properly verified can be exploited by an authenticated user to
modify other users' Personal Profile settings (e.g. change the
administrator's password)

5) Input passed to the "savefolder" and "savefilename" parameters in
"downloadfile" isn't properly sanitised before being used to download
e-mail attachments. This can be exploited by an authenticated user to
disclose the content of arbitrary files via directory traversal
attacks.

6) Input passed to the "in_name" parameter when configuring the
user's name in the Personal Profile settings isn't properly sanitised
before being used. This can be exploited to inject arbitrary HTML and
script code, which will be executed in an administrator's browser
session in context of an affected site when the malicious user data
is viewed when listing users.

Successful exploitation requires that the user has been
authenticated.

The vulnerabilities have been reported in versions 5.06 and 5.07
(build.200607050). Prior versions may also be affected.

SOLUTION:
Update to version 5.08.
http://www.neosys.ne.jp/neosys/dl.htm

PROVIDED AND/OR DISCOVERED BY:
Tan Chew Keong

ORIGINAL ADVISORY:
vuln.sg:
http://vuln.sg/neonmail506-en.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------