BaseFortify

Detection Guidance

This vulnerability can be detected by checking for the presence of the AUTH.TAB file in MailEnable installations and verifying its permissions and contents. Specifically, you can look for the AUTH.TAB file and check if it contains plaintext passwords and if its filesystem permissions allow read access to local authenticated users. Suggested commands on a system hosting MailEnable include: 1) Locate the AUTH.TAB file, typically under the MailEnable installation directory, e.g., using 'dir /s AUTH.TAB' on Windows. 2) Check the file permissions with 'icacls AUTH.TAB' to see if non-administrative users have read access. 3) Inspect the file contents (if permitted) with 'type AUTH.TAB' to see if passwords are stored in cleartext. These steps help identify if the vulnerable condition exists on the system.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in MailEnable versions prior to 10.54, where user and administrative passwords are stored in cleartext within the AUTH.TAB file. The file has overly permissive filesystem access, allowing a local authenticated user with read access to recover all user passwords and super-admin credentials. This enables unauthorized access to MailEnable services such as POP3, SMTP, or the webmail interface.

Useful 0 Not Useful 0

Impact Analysis

An attacker who gains local authenticated access and can read the AUTH.TAB file can obtain all user and administrative passwords in plaintext. This can lead to account takeover, unauthorized mailbox access, and administrative control over MailEnable services, potentially compromising sensitive email communications and system integrity.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately restrict filesystem permissions on the AUTH.TAB file to prevent unauthorized read access. Ensure that only trusted administrative users have access to this file. Additionally, upgrade MailEnable to version 10.54 or later where this issue is resolved. Consider resetting all user and administrative passwords after applying these changes to prevent compromised credentials from being used.

Useful 0 Not Useful 0