PT-2005-1442 · Argosoft · Argosoft Mail Server Pro

Tan Chew Keong · Publicado 2005-02-09 · Atualizado 2016-10-18 · CVE-2005-0367

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ArGoSoft Mail Server version 1.8.7.3

Description The issue allows remote authenticated users to read, delete, or upload arbitrary files due to multiple directory traversal vulnerabilities. This can be achieved by including a .. (dot dot) in specific parameters, such as the filename of an e-mail attachment, the msgatt.rec file, or the Folder parameter in various operations like /msg, /delete, /folderadd, and /folderdelete.

Recommendations For ArGoSoft Mail Server version 1.8.7.3, consider restricting access to the affected operations, such as /msg, /delete, /folderadd, and /folderdelete, until a patch is available. As a temporary workaround, avoid using the .. (dot dot) sequence in filenames of e-mail attachments and the msgatt.rec file to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-0367

Produtos afetados

Argosoft Mail Server Pro

Referências · 4

• 🔥 http://security.org.sg/vuln/argosoftmail1873.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-0367 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=110796956011699&w=2 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0367 · Nota