Secunia

Matthias Kilian has discovered a security issue in Ecartis, which can be exploited by malicious people to bypass certain security restrictions.

The security issue is caused due to a design error, which causes attachments in emails that are sent to the [listname]-request@[hostname] addresses to be saved to the "pantomime" web-accessible directory even when the sender is not subscribed to the mailing list or when the list is closed. This can potentially be exploited by malicious people to place arbitrary files onto the server.

Successful exploitation requires that the "pantomime" functionality has been enabled for the mailing list.

The security issue has been confirmed in version 1.0.0 snapshot 20050909. Other versions may also be affected.

Solution
Disable the "pantomime" functionality.
Further details available in Customer Area

Provided and/or discovered by
Matthias Kilian

Changelog
Further details available in Customer Area

Original Advisory
http://marc.theaimsgroup.com/?l=listar-dev&m=113732552708625&w=2

Deep Links
Links available in Customer Area