PT-2004-2580 · Icewarp · Merak Mail Server

Publicado 2004-10-12 · Atualizado 2017-07-11 · CVE-2004-1674

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Merak Mail Server version 7.4.5

Description The issue allows remote attackers to delete or move arbitrary files. This can be achieved through the viewaction.html page in Merak Mail Server with Icewarp Web Mail. Specifically, attackers can delete files via the originalfolder parameter or move files via the messageid parameter.

Recommendations For Merak Mail Server version 7.4.5, consider restricting access to the viewaction.html page until a fix is available. As a temporary workaround, limit the use of the originalfolder and messageid parameters to prevent file deletion and movement.

Correção

Identificadores relacionados

CVE-2004-1674

Produtos afetados

Merak Mail Server

Referências · 5

• http://marc.info/?l=bugtraq&m=109483971420067&w=2 · Nota
• http://securityfocus.com/bid/11371 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-1674 · Nota de Segurança
• http://secunia.com/advisories/12789 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17976 · Nota