PT-2004-3463 · Amax · Amax Magic Winmail Server

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2572

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions AMAX Magic Winmail Server version 3.6

Description The issue allows remote attackers to obtain sensitive information by entering invalid characters, such as (), or a large number of characters in the "Lookup" field on the "netaddressbook.php" web form. This reveals the path in an "ldaplib.php" error message when the ldap search function fails due to improper processing of the $keyword variable.

Recommendations For AMAX Magic Winmail Server version 3.6, consider restricting input in the "Lookup" field on the "netaddressbook.php" web form to prevent the entry of invalid or excessive characters, and ensure proper validation and sanitization of the $keyword variable to prevent information disclosure.

Exploit

Correção

Identificadores relacionados

CVE-2004-2572

Produtos afetados

Amax Magic Winmail Server

Referências · 8

• 🔥 http://osvdb.org/4118 · Exploit
• 🔥 http://members.lycos.co.uk/r34ct/main/ldaplib/ldaplib.php%20reveal%20local%20path%20of%20Winmail%203.6%20webmail%20directory.txt · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15361 · Nota
• http://magicwinmail.net/download/english-help.chm · Nota
• http://securityfocus.com/bid/9786 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2572 · Nota
• http://secunia.com/advisories/11015 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-2572 · Nota de Segurança