Some serious security holes in 'The Bat!'

[Bipin Gautam hUNT3R <door_hunt3r@blackcodemail.com>]

'The Bat!' [http://www.ritlabs.com/] is a powerful, highly configurable, 
MULTI-USER, yet easy to use email client.

I have discoverd some serious security holes in 'The Bat!'

mmm..., when a new account is created in 'The Bat!' It creates the account in 
%programfiledir%\The Bat!\MAIL\ without implimenting any proper ACL! so even a 
guest USER IS ABLE TO READ! THE "MESSAGES.TBB" "MESSAGES.TBI" of both 'INBOX' 
AND 'OUTBOX' by just creating a new account [in a local or remote PC] and 
putting the files in the NEW USERS 'inbox' and 'outbox' and using ! The Bat! 
itself to READ THE FILE/email's.


More sevier, "MESSAGES.TBB" and "MESSAGES.TBI" are stored in PLAIN TEXT!!!

Even worst! The Bat! stores the password in Account.cfg of the users 
directory... [say... %programfiledir%\The Bat!\MAIL\NEW_USER\] If there is 
another user have equal right's! he could just delete the account.cfg and READ 
another USER'S PASSWORD PROTECTED EMAIL WITHOUT ANY PROBLEM's!!!/RESTRICTION!!!

---------------------
FUNNY
---------------------
I copied the ACCOUNT.CFG file from the %programfiledir%\The 
Bat!\MAIL\ADMINISTRATOR\

I WAS ABLE TO inject the encrypted password of mine [simply, using a hex 
editor] into the ACCOUNT.CFG of \ADMINISTRATOR\ by copying it to a new 
directory and then making few email adjustments etc... i was completely able 
to, not only HIJACK "MESSAGES.TBB" and "MESSAGES.TBI"
of the admin. account but also TAKING CONTROL/ACCESSING/USE ACCOUNT.CFG of the 
ADMINistrator form a guest account.

------------------------------------------------
 Some possible solution, until update's are relesed!
------------------------------------------------
Creating the new user account in %userprofile% [when possible] insted of 
%programfiledir%\The Bat!\MAIL\ or changing path of The Bat! folder to 
%userprofile% so that ACL's of NTFS will handle the rest!

[After you create a new account [folder] in %userprofile% you could then simply 
copy all of your goodees from %programfiledir%\The Bat!\MAIL\YOUR_ACCOUNT-FILE 
to %userprofile%\YOUR_ACCOUNT-FILE \

Checking proper ACL! manually, or implimenting proper rules by using a 3'rd 
party software so that it's hard to SPY INTO "MESSAGES.TBB" and "MESSAGES.TBI" 
by unauthorised USER!

--------------------------------
Shouldn't the developer's....
--------------------------------
Store the encrypted password in the headers of "MESSAGES.TBB" and 
"MESSAGES.TBI" insted of seperate file!!! so that 'The Bat!' can effectively 
check if the file is password protected or not before it opens the content!
Encrypting the content's of "MESSAGES.TBB" and "MESSAGES.TBI" [and other cfg 
files...] insted of putting it all in a plain text!!!

I don't think the developrs wanna see a worm that grep's all the @ [heee... 
email account's] from "MESSAGES.TBB" and "MESSAGES.TBI" files AND PLAY 
THRASH.....

--[Background Information]--
This bug was originally discovered by hUNT3R, a member of 01 Security 
Sumbission. The vendor was notified via email.
http://www.ysgnet.com/hn