PT-2006-6202 · Marshal · Mailmarshal For Exchange+1

Publicado 2006-11-10 · Atualizado 2018-10-17 · CVE-2006-5487

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Marshal MailMarshal SMTP versions 5.x through 6.x Marshal MailMarshal SMTP version 2006 MailMarshal for Exchange versions 5.x

Description A directory traversal issue allows remote attackers to write arbitrary files via ".." sequences in filenames in an ARJ compressed archive.

Recommendations For Marshal MailMarshal SMTP versions 5.x through 6.x, update to a version that fixes this issue. For Marshal MailMarshal SMTP version 2006, update to a version that fixes this issue. For MailMarshal for Exchange versions 5.x, update to a version that fixes this issue. As a temporary workaround, consider restricting access to ARJ compressed archives until a patch is available.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2006-5487

Produtos afetados

Mailmarshal For Exchange

Marshal Mailmarshal Smtp

Referências · 10

• http://securityfocus.com/bid/20999 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30188 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5487 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-06-039.html · Aviso do Fabricante
• http://securitytracker.com/id?1017209 · Nota
• http://secunia.com/advisories/22806 · Aviso do Fabricante
• http://securityfocus.com/archive/1/451143/100/0/threaded · Nota
• http://securityreason.com/securityalert/1857 · Nota
• http://marshal.com/kb/article.aspx?id=11450 · Correção
• http://vupen.com/english/advisories/2006/4457 · Nota