PT-2005-4226 · Rockliffe · Rockliffe Mailsite Express

Paul Craig · Published 2005-11-02 · Updated 2017-07-11 · CVE-2005-3430

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Rockliffe MailSite Express versions prior to 6.1.22

Description The issue allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions, such as .unk, .asa, and possibly .htr and .aspx, which are not filtered like the .asp extension.

Recommendations For versions prior to 6.1.22, update to version 6.1.22 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to only necessary extensions to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-3430

Affected Products

Rockliffe Mailsite Express

References · 9

• http://security-assessment.com/Advisories/Rockliffe_Express_Webmail_Vulnerabilities.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3430 · Security Note
• http://secunia.com/advisories/17240 · Vendor Advisory
• http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0578.html · Patch
• http://securitytracker.com/id?1015117 · Note
• http://marc.info/?l=bugtraq&m=113053680631151&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3430 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22907 · Note
• http://securityfocus.com/bid/15230 · Note