Open WebMail 1.71 "background" magic info

• Previous message: securityat_private: "Security Update: [CSSA-2002-052.0] Linux: sendmail smrsh bypass vulnerabilities"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hello Folks,

Open Webmail is a perl webmail program that runs on UNIX operational systems. 
For more about Open WebMail, itīs official website is http://openwebmail.org/.

Ok, letīs talk about the problem.

Iīve tested Open WebMail 1.71 an when you enter an invalid username (user 
that doesnīt exist on the system), the 
WebMail returns to you a "very nice screen" like it:

---
Open WebMail ERROR 

user does not exist 

Open WebMail version 1.71 
---

Ok, now try to copy with your mouse the all message that returned to you, 
and...

---
Open WebMail ERROR 

user does not exist 
euid=0, egid=80 80 80, mailgid=6 

Open WebMail version 1.71 
---

...KABOOM! Look what magically appears:

"euid=0, egid=80 80 80, mailgid=6"

allright, letīs verify the information:

ps aux
root        9044  0.0  3.0  3248 2776  ??  R    10:29AM   
0:00.40 /usr/bin/perl -T /usr/local/www/cgi-bin/openwebmail/.openwebmail.pl

As you can see above, the perl scrip run as root, and we can know it just 
with the "magically information" that appears on the "very nice screen".

Thatīs could be the begin for an attack... know information. 

Yeah guys, something is wrong... Some information is better than we can 
imagine, and some information like it to the wrong (or right) guys... :)

Hugs,

Felipe Neuwald
felipeat_private

--
FreeBSDbr.com.br

• Next message: HggdH: "Re: [Full-Disclosure] MS02-065 vulnerability"
• Previous message: securityat_private: "Security Update: [CSSA-2002-052.0] Linux: sendmail smrsh bypass vulnerabilities"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Sat Nov 23 2002 - 08:00:30 PST