PT-2006-1939 · Nocc · Nocc Webmail

Published 2006-02-25 · Updated 2008-09-05 · CVE-2006-0893

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions NOCC Webmail version 1.0

Description The issue allows remote attackers to obtain sensitive information by making a direct request to the "profiles directory" and the "tmp directory". The profiles directory leaks e-mail addresses contained in filenames of profiles, while the tmp directory lists names of uploaded attachments.

Recommendations For NOCC Webmail version 1.0, restrict access to the profiles and tmp directories to prevent information leakage. As a temporary workaround, consider disabling direct access to these directories until a more permanent solution is available.

Exploit

Fix

Related Identifiers

CVE-2006-0893

Affected Products

Nocc Webmail

References · 8

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2006-02/0418.html · Exploit
• http://secunia.com/advisories/16921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0893 · Security Note
• http://osvdb.org/23420 · Note
• http://securitytracker.com/id?1015671 · Note
• http://securityfocus.com/bid/16793 · Note
• http://osvdb.org/23422 · Note
• http://retrogod.altervista.org/noccw_10_incl_xpl.html · Note