PT-2005-1391 · Magic · Magic Winmail Server

Tan Chew Keong · Publicado 2005-01-27 · Atualizado 2017-07-11 · CVE-2005-0313

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Magic Winmail Server version 4.0 Build 1112

Description The issue allows remote attackers to upload arbitrary files via certain parameters to "upload.php" or read arbitrary files via certain parameters to "download.php". Additionally, remote authenticated users can read, create, or delete arbitrary directories and files via the IMAP commands CREATE, EXAMINE, SELECT, or DELETE.

Recommendations For Magic Winmail Server version 4.0 Build 1112, consider restricting access to the "upload.php" and "download.php" scripts until a patch is available. As a temporary workaround, limit the use of IMAP commands CREATE, EXAMINE, SELECT, and DELETE to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-0313

Produtos afetados

Magic Winmail Server

Referências · 10

• 🔥 https://exploit-db.com/exploits/25064 · Exploit
• 🔥 https://exploit-db.com/exploits/25065 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19114 · Nota
• http://marc.info/?l=bugtraq&m=110685011825461&w=2 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0313 · Nota
• http://securityfocus.com/bid/12388 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-0313 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19108 · Nota
• http://secunia.com/advisories/14053 · Nota
• http://securitytracker.com/id?1013017 · Nota