Secunia

Secunia Research has discovered a vulnerability in NeoMail, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to missing validation of the Session ID in the "addfolder()" and "deletefolder()" functions in neomail-prefs.pl. This can be exploited to create mail-folder files in arbitrary directories writable by the mail group (e.g. in users' "/var/neomail/users" NeoMail directories), and to delete mail-folder files created by arbitrary users if the names of the folder files are known.

Successful exploitation requires that NeoMail is configured with $homedirfolders = 'no' and $homedirspools = 'no'.

The vulnerability has been confirmed in version 1.28. Prior versions may also be affected.

Solution
Update to version 1.29.
Further details available in Customer Area

Provided and/or discovered by
Tan Chew Keong, Secunia Research.

Changelog
Further details available in Customer Area

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2006-3/advisory/

NeoMail:
http://sourceforge.net/project/shownotes.php?release_id=392562&group_id=2874

Deep Links
Links available in Customer Area