Symantec Messaging Gateway Arbitrary file download is possible with a crafted URL (authenticated)
Summary
Name: Symantec Messaging Gateway – Arbitrary file download is possible with a crafted URL (authenticated)
Release Date: 30 November 2012
Reference: NGS00266
Discoverer: Ben Williams
Vendor: Symantec
Vendor Reference:
Systems Affected: Symantec Messaging Gateway 9.5.3-3
Risk: Medium
Status: Published
TimeLine
Discovered: 17 April 2012
Released: 17 April 2012
Approved: 29 April 2012
Reported: 30 April 2012
Fixed: 27 August 2012
Published: 30 November 2012
Description
I. VULNERABILITY
Symantec Messaging Gateway 9.5.3-3 – Arbitrary file download is possible with a crafted URL (authenticated)
II. BACKGROUND
Symantec Messaging Gateway 9.5.3-3 is the latest version, of their Email Security Appliance
III. DESCRIPTION
The vulnerability would enable an attacker (who has authenticated to the web interface) to download arbitrary files from the appliance with the permissions of the Webserver user
Technical Details
IV. PROOF OF CONCEPT
————————-
Various files containing sensitive information can be downloaded using a crafted URL for example:
Which produces a file containing:
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/bin/bash
ntp:x:38:38::/etc/ntp:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
postfix:x:100:101::/home/postfix:/bin/bash
mailwall:x:500:501::/home/mailwall:/bin/bash
mysql:x:501:103::/home/mysql:/bin/bash
bcc:x:502:99::/home/bcc:/bin/bash
support:x:503:503::/home/support:/bin/bash
admin:x:504:501::/home/admin:/bin/rbash
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
named:x:25:25:Named:/var/named:/sbin/nologin
Simliar issues can be seen in other places such as here:
Fix Information
An updated version of the software has been released to address the vulnerability: