PT-2006-1026 · Ingo · Ingo H3

Michael Menge · Published 2006-10-23 · Updated 2011-03-08 · CVE-2006-5449

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Ingo H3 versions prior to 1.1.2

Description: The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the mailbox destination of a filter rule. Multiple vulnerabilities in the ingo1 package may lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited by a remote attacker who has passed the authentication procedure.

Recommendations: For Ingo H3 versions prior to 1.1.2, update to version 1.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to filter rules to minimize the risk of exploitation. Avoid using shell metacharacters in the mailbox destination of filter rules until the issue is resolved.

Fix

Related Identifiers

BDU:2015-03438

CVE-2006-5449

DSA-1204-1

Affected Products

Ingo H3

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2006-5449 · Security Note
• http://debian.org/security/2006/dsa-1204 · Vendor Advisory
• http://bugs.horde.org/ticket/?Horde=6ed1a009f3396864553976a45948339e&id=4513 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5449 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200611-22.xml · Vendor Advisory
• http://secunia.com/advisories/22482 · Vendor Advisory
• http://securityfocus.com/bid/20637 · Patch
• http://lists.horde.org/archives/announce/2006/000296.html · Patch
• https://bdu.fstec.ru/vul/2015-03438 · Security Note
• http://vupen.com/english/advisories/2006/4124 · Note
• http://debian.org/security/dsa-1204 · Note
• http://secunia.com/advisories/23100 · Note
• http://secunia.com/advisories/22656 · Note