PT-2006-6202 · Marshal · Mailmarshal For Exchange+1

Published 2006-11-10 · Updated 2018-10-17 · CVE-2006-5487

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Marshal MailMarshal SMTP versions 5.x through 6.x Marshal MailMarshal SMTP version 2006 MailMarshal for Exchange versions 5.x

Description A directory traversal issue allows remote attackers to write arbitrary files via ".." sequences in filenames in an ARJ compressed archive.

Recommendations For Marshal MailMarshal SMTP versions 5.x through 6.x, update to a version that fixes this issue. For Marshal MailMarshal SMTP version 2006, update to a version that fixes this issue. For MailMarshal for Exchange versions 5.x, update to a version that fixes this issue. As a temporary workaround, consider restricting access to ARJ compressed archives until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2006-5487

Affected Products

Mailmarshal For Exchange

Marshal Mailmarshal Smtp

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2006-5487 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-06-039.html · Vendor Advisory
• http://secunia.com/advisories/22806 · Vendor Advisory
• http://marshal.com/kb/article.aspx?id=11450 · Patch
• http://securityfocus.com/bid/20999 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30188 · Note
• http://securitytracker.com/id?1017209 · Note
• http://securityfocus.com/archive/1/451143/100/0/threaded · Note
• http://securityreason.com/securityalert/1857 · Note
• http://vupen.com/english/advisories/2006/4457 · Note