PT-2008-2096 · Absofort Aconon · Absofort Aconon Mail 2004 Enterprise Sql+1

Arno Toll · Publicado 2008-01-25 · Atualizado 2017-09-29 · CVE-2008-0464

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions absofort aconon Mail 2007 Enterprise SQL version 11.7.0 absofort aconon Mail 2004 Enterprise SQL version 11.5.1

Description A directory traversal issue exists in the archiv.cgi component, allowing remote attackers to read arbitrary files by including a .. (dot dot) in the template parameter.

Recommendations For absofort aconon Mail 2007 Enterprise SQL version 11.7.0, restrict access to the archiv.cgi component until a fix is available. For absofort aconon Mail 2004 Enterprise SQL version 11.5.1, avoid using the template parameter in the archiv.cgi component until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-0464

Produtos afetados

Absofort Aconon Mail 2004 Enterprise Sql

Absofort Aconon Mail 2007 Enterprise Sql

Referências · 7

• 🔥 http://securityfocus.com/bid/27427 · Exploit
• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059856.html · Exploit
• 🔥 https://exploit-db.com/exploits/4977 · Exploit
• http://burnachurch.com/67/directory-traversal-luecke-in-aconon-mail · Nota
• http://vupen.com/english/advisories/2008/0310 · Nota
• http://secunia.com/advisories/28617 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-0464 · Nota de Segurança