PT-2011-2045 · Great Circle Associates · Majordomo

Published 2011-02-04 · Updated 2024-02-14 · CVE-2011-0049

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Majordomo versions prior to 20110131

Description The issue allows remote attackers to read arbitrary files via .. (dot dot) sequences in the help command. This can be achieved by sending a crafted email or by exploiting the web interface, specifically the cgi-bin/mj wwwusr endpoint.

Recommendations For versions prior to 20110131, update to version 20110131 or later to resolve the issue. As a temporary workaround, consider restricting access to the help command and the cgi-bin/mj wwwusr endpoint in the web interface until the update is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2011-0049

Affected Products

Majordomo

References · 16

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/majordomo2_directory_traversal.rb · Exploit
• 🔥 http://securityfocus.com/bid/46127 · Exploit
• 🔥 https://sitewat.ch/en/Advisory/View/1 · Exploit
• 🔥 http://exploit-db.com/exploits/16103 · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=628064 · Exploit
• 🔥 https://exploit-db.com/exploits/16103 · Exploit
• http://secunia.com/advisories/43125 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0049 · Security Note
• https://bug628064.bugzilla.mozilla.org/attachment.cgi?id=506481 · Patch
• http://securityfocus.com/archive/1/516150/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65113 · Note
• http://kb.cert.org/vuls/id/363726 · Note
• http://vupen.com/english/advisories/2011/0288 · Note
• http://securityreason.com/securityalert/8061 · Note
• http://securitytracker.com/id?1025024 · Note