PT-2004-2576 · Icewarp · Merak Mail Server

Shineshadow · Publicado 2004-09-10 · Atualizado 2017-07-11 · CVE-2004-1670

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Merak Mail Server version 7.4.5

Description The issue allows remote attackers to create arbitrary directories or rename arbitrary files. This can be achieved by exploiting directory traversal vulnerabilities, specifically by using a .. (dot dot) in the user parameter to viewaction.html or a ....// (doubled dot dot) in the folderold or folder parameters to folders.html.

Recommendations For Merak Mail Server version 7.4.5, consider restricting access to the viewaction.html and folders.html endpoints until a patch is available. As a temporary workaround, avoid using the user, folderold, and folder parameters in the affected API endpoints.

Correção

Identificadores relacionados

CVE-2004-1670

Produtos afetados

Merak Mail Server

Referências · 5

• http://marc.info/?l=bugtraq&m=109483971420067&w=2 · Nota
• http://securityfocus.com/bid/11371 · Aviso do Fabricante
• http://secunia.com/advisories/12789 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17314 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1670 · Nota de Segurança