PT-2004-2580 · Icewarp · Merak Mail Server

Published 2004-10-12 · Updated 2017-07-11 · CVE-2004-1674

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Merak Mail Server version 7.4.5

Description The issue allows remote attackers to delete or move arbitrary files. This can be achieved through the viewaction.html page in Merak Mail Server with Icewarp Web Mail. Specifically, attackers can delete files via the originalfolder parameter or move files via the messageid parameter.

Recommendations For Merak Mail Server version 7.4.5, consider restricting access to the viewaction.html page until a fix is available. As a temporary workaround, limit the use of the originalfolder and messageid parameters to prevent file deletion and movement.

Fix

Related Identifiers

CVE-2004-1674

Affected Products

Merak Mail Server

References · 5

• http://securityfocus.com/bid/11371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1674 · Security Note
• http://secunia.com/advisories/12789 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=109483971420067&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17976 · Note