'[FD] POP Peeper 4.0.1 - Persistent Code Execution Vulnerability'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] POP Peeper 4.0.1 - Persistent Code Execution Vulnerability
From:       Vulnerability Lab <research () vulnerability-lab ! com>
Date:       2015-12-22 15:06:36
Message-ID: 567966FC.9030806 () vulnerability-lab ! com
[Download RAW message or body]

Document Title:
===============
POP Peeper 4.0.1 - Persistent Code Execution Vulnerability

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1657

Release Date:
=============
2015-11-26

Vulnerability Laboratory ID (VL-ID):
====================================
1657

Common Vulnerability Scoring System:
====================================
5.7

Product & Service Introduction:
===============================
Email notifier that runs in the Windows task bar and alerts you when you have new email on any \
of account. POP Peeper is an email notifier that runs in your  Windows task bar and alerts you \
when you have new email on your POP3, IMAP (with IDLE support), Hotmai-MSN-LiveMail, Yahoo, \
GMail, MyWay, Excite, iWon,  Lycos.com, RediffMail, Juno and NetZero accounts. IMAP supports \
allows you to access AOL, AIM, Netscape and other services. Send mail directly from POP Peeper  \
and use the address book to email your frequently used contacts. POP Peeper allows you to view \
messages using HTML or you can choose to safely view all messages  in rich or plain text. \
Several options are available that will decrease or eliminate the risks of reading your email \
(viruses, javascript, webbugs, etc). POP  Peeper can be run from a portable device and can be \
password protected. Many notification options are availble to indicate when new mail has \
arrived, such as  sound alerts (configurable for each account), flashing scroll lock, skinnable \
popup notifier, customized screensaver and more.

(Copy of the Vendor Homepage: http://data.esumsoft.com/download/POPPeeperPro.zip )

Abstract Advisory Information:
==============================
An independent vulnerability laboratory researcher discovered a code execution vulnerability in \
the official POP Peeper v4.0.1 software.

Vulnerability Disclosure Timeline:
==================================
2015-11-23:	Public Disclosure (Vulnerability Laboratory)

Discovery Status:
=================
Published

Affected Product(s):
====================
Esumsoft
Product: POP Peeper - Software 4.0.1

Exploitation Technique:
=======================
Local

Severity Level:
===============
Medium

Technical Details & Description:
================================
A code execution vulnerability has been discovered in the official POP Peeper v4.0.1 software. \
An attacker can download a remote program from a  malicious URL is Register by default. I \
created a video that demonstrates how to download a software on a victim website created by the \
attacker.

Proof of Concept (PoC):
=======================
The vulnerability can be exploited by local attackers with low pivileged system user account \
and without user interaction. For security demonstration or to reproduce follow the provided \
information and steps below to continue.

Manual steps to reproduce the vulnerability ...
1. Launch POP Peeper.exe                
2. Click Tools -> Options -> General                 
3. Paste malicious url in input "Email Client"
4. Click ok and Clik Compose
5. PHP code executed successfully!

PoC Exploit:
<?php
eval(base64_decode('ZXZhbChiYXNlNjRfZGVjb2RlKCdaWFpoYkNoaVlYTmxOalJmWkdWamIy
                   UmxLQ2RhV0doc1dYbG5ibEY2Y0dOV01HeFBVa1U1V0ZVeGVIcGxXRTR3V
                   2xjd2VrMXNlR3BaVjNocVRHMVdORnBUWTNCUGR6MDlKeWtwT3c9PScpKTs='));
?>

Video Demonstration: http://zwx.fr/videos/POPPeeper.html

Security Risk:
==============
The security risk of the code execution vulnerability in the POP Peeper 4.0.1 software is \
estimated as medium. (CVSS 5.7)

Credits & Authors:
==================
ZwX - (http://zwx.fr) [ http://www.vulnerability-lab.com/show.php?user=ZwX ]

Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. \
Vulnerability Lab disclaims all warranties, either expressed  or implied, including the \
warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its \
suppliers are not liable  in any case of damage, including direct, indirect, incidental, \
consequential loss of business profits or special damages, even if Vulnerability-Lab  or its \
suppliers have been advised of the possibility of such damages. Some states do not allow the \
exclusion or limitation of liability for  consequential or incidental damages so the foregoing \
limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,  \
policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       		- www.evolution-sec.com
Contact:    admin@vulnerability-lab.com 	- research@vulnerability-lab.com 	       		- \
                admin@evolution-sec.com
Section:    magazine.vulnerability-db.com	- vulnerability-lab.com/contact.php		       	- \
                evolution-sec.com/contact
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       		- \
                youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   		- \
                vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php  	- \
vulnerability-lab.com/list-of-bug-bounty-programs.php	- vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires \
authorization from Vulnerability Laboratory. Permission to  electronically redistribute this \
alert in its unmodified form is granted. All other rights, including the use of other media, \
are reserved by  Vulnerability-Lab Research Team or its suppliers. All pictures, texts, \
advisories, source code, videos and other information on this website  is trademark of \
vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use \
or edit our material contact  (admin@vulnerability-lab.com or research@vulnerability-lab.com) \
to get a permission.

				Copyright  © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]â„¢

-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@vulnerability-lab.com
PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

[prev in list] [next in list] [prev in thread] [next in thread] 