PT-2006-3832 · Qbik · Wingate

Published 2006-07-10 · Updated 2011-03-08 · CVE-2006-2917

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions WinGate versions 6.1.2.1094 through 6.1.3.1096 WinGate versions prior to 6.1.4 Build 1099

Description The issue allows remote authenticated users to perform unauthorized operations, such as reading email of other users or modifying directories, by exploiting a directory traversal vulnerability in the IMAP server. This can be achieved via various IMAP commands, including CREATE, SELECT, DELETE, RENAME, COPY, APPEND, and LIST.

Recommendations For WinGate versions 6.1.2.1094 through 6.1.3.1096, update to version 6.1.4 Build 1099 or later. For WinGate versions prior to 6.1.4 Build 1099, update to version 6.1.4 Build 1099 or later.

Fix

Related Identifiers

CVE-2006-2917

Affected Products

Wingate

References · 6

• http://secunia.com/secunia_research/2006-48/advisory · Vendor Advisory
• http://secunia.com/advisories/20707 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2917 · Security Note
• http://wingate.com/download.php · Note
• http://securityfocus.com/bid/18908 · Note
• http://vupen.com/english/advisories/2006/2730 · Note