|
MailSite IMAP Service RENAME Command Directory Traversal
|
|
Secunia Advisory:
|
SA18318
|
|
|
Release Date:
|
2006-01-05
|
|
Last Update:
|
2006-08-04
|
|
Popularity:
|
5,182 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Exposure of sensitive information
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | MailSite 6.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2006-0130
CVE-2006-0127
CVE-2006-0129
|
|
Description:
Josh Zlatin-Amishav has discovered a vulnerability in MailSite Email Server, which can be exploit by malicious users to gain knowledge of sensitive information.
The vulnerability is caused due to missing validation of the parameters passed to the RENAME command of the IMAP service. This can be exploited to rename the IMAP folders of other users, potentially allowing a malicious user to read the emails of other users via directory traversal attacks.
The vulnerability has been confirmed in version 6.1.22.0. Prior versions may also be affected.
Note: It is also possible to enumerate user names due to differences in messages returned from the Management Server (106/tcp).
Solution:
Update to version 6.1.22.1
http://www.rockliffe.com/userroom/download.asp
Provided and/or discovered by:
Josh Zlatin-Amishav
Changelog:
2006-01-26: Added CVE reference.
2006-08-04: Added CVE references.
Original Advisory:
http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/040969.html
http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/040970.html
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
