An application security bybass method was discovered that could allow a user with a valid Hastymail account to send commands to either the IMAP or SMTP server directly by embeding an "end of command" sequence followed by a hand written command, into a Hastymail variable. Under normal circumstances Hastymail decides what IMAP and SMTP commands to send. Using this method a malicous user could send any command they wanted to either the IMAP or SMTP server software. If either one of these services is vulnerable to a remote exploit this application security bypass in Hastymail could give an attacker an avenue with which to attempt to exploit the IMAP or SMTP services. Again, only valid logged in Hastymail users could take advantage of this bypass. While I would not classify this issue as critical, I would urge everyone to upgrade to 1.5 if not already, and to apply the following patch:

diff -u -u hastymail-1.5/lib/session.php hastymail-1.5-patched/lib/session.php
--- hastymail-1.5/lib/session.php   2006-10-08 17:19:58.000000000 -0500
+++ hastymail-1.5-patched/lib/session.php   2006-10-08 17:22:52.000000000 -0500
@@ -66,7 +66,7 @@
                         }
                         break;
                     case 'folder':
-                            $checked[$key] = (string) $value;
+                            $checked[$key] = (string) (str_replace(array("\n", "\r"), '', $value));
                         break;
                     case 'int':
                             $checked[$key] = (int) intval($value);
diff -u -u hastymail-1.5/lib/smtp.php hastymail-1.5-patched/lib/smtp.php
--- hastymail-1.5/lib/smtp.php  2006-10-08 17:18:31.000000000 -0500
+++ hastymail-1.5-patched/lib/smtp.php  2006-10-08 17:22:52.000000000 -0500
@@ -352,6 +352,7 @@
         $smtp_message .= 'x-priority: '.$priority."\r\n";
     }
     $smtp_message .= "MIME-Version: 1.0\r\n";
+    $smtp_message = preg_replace("/^\.\r\n/", "..\r\n", $smtp_message);
     $size = 0;
     $bndry = '';

An information disclosure issue was found in the development version of Hastymail with the style.php file in which an attacker could abuse the file to read arbitrary files on the server (that are readable by the user the webserver runs as). No remote code execution is present from this however it does represent an unacceptable information disclosure risk so we recommend all users either apply the supplied patch, use the drop in replacement for style.php, or upgrade to the 1.4 (or newer) version of hastymail.

A security issue was found in both the stable and development versions of Hastymail that effects IE users and the "download" link on the message view page. If a user downloads a HTML part, even though the MIME type of the part is set to application/octect-stream, because we did not define the "attachment" paramater to the Content-Disposition HTTP header, Internet Explorer will look at the file extension and open the attachment inline. This is dangerous because the attachment is unfiltered at this point, and could contain Javascript or activeX code. With the fix in place Internet Explorer will not open the HTML file but instead prompt the user to save or open it.

• Remove nasty parts of HTML messages (like scripts) as well as images and links.
• Run without any Javascript support in the web browser. Hastymail is all W3C compliant HTML
• Use a dynamic session identifier that is only good for one page load, then expires. making it useless if "stolen".
• Validate the current users IP address and browser string on each page load.
• Use a cookie with a randomly generated value that changes on each page load to protect against session highjacking.