[UNIX] SqWebMail Conditional Comments Script Insertion

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

SqWebMail Conditional Comments Script Insertion
------------------------------------------------------------------------

SUMMARY

Secunia Research has discovered a vulnerability in SqWebMail, which can be
exploited by malicious people to conduct script insertion attacks.

DETAILS

Vulnerable Systems:
* SqWebMail version 5.0.4

The vulnerability is caused due to SqWebMail allowing usage of e.g. the
"<script>" tag within an HTML comment. This, combined with "Conditional
Comments" in Internet Explorer, can be exploited to execute arbitrary
script code in a user's browser session in context of a vulnerable site
when a malicious email is viewed.

Successful exploitation requires that the user is using Internet Explorer.

Example in an HTML email:
<!--[if IE]>
<script>alert("Vulnerable!");</script>
<![endif]-->

Solution:
The vendor has issued an updated version of SqWebMail, which fixes this
vulnerability: <http://www.courier-mta.org/?download.php>
http://www.courier-mta.org/?download.php.

Disclosure Timeline:
05/09/2005 - Initial vendor notification
05/09/2005 - Vendor confirms vulnerability and releases a fix
06/09/2005 - Public disclosure

ADDITIONAL INFORMATION

The information has been provided by <mailto:vuln@secunia.com> Secunia
Research.
The original article can be found at:
<http://secunia.com/secunia_research/2005-44/advisory/>
http://secunia.com/secunia_research/2005-44/advisory/

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.