PT-2005-1442 · Argosoft · Argosoft Mail Server Pro

Tan Chew Keong · Published 2005-02-09 · Updated 2016-10-18 · CVE-2005-0367

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ArGoSoft Mail Server version 1.8.7.3

Description The issue allows remote authenticated users to read, delete, or upload arbitrary files due to multiple directory traversal vulnerabilities. This can be achieved by including a .. (dot dot) in specific parameters, such as the filename of an e-mail attachment, the msgatt.rec file, or the Folder parameter in various operations like /msg, /delete, /folderadd, and /folderdelete.

Recommendations For ArGoSoft Mail Server version 1.8.7.3, consider restricting access to the affected operations, such as /msg, /delete, /folderadd, and /folderdelete, until a patch is available. As a temporary workaround, avoid using the .. (dot dot) sequence in filenames of e-mail attachments and the msgatt.rec file to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-0367

Affected Products

Argosoft Mail Server Pro

References · 4

• 🔥 http://security.org.sg/vuln/argosoftmail1873.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-0367 · Security Note
• http://marc.info/?l=bugtraq&m=110796956011699&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0367 · Note