|
 |
|
Marshal MailMarshal ARJ Archive Directory Traversal
|
|
|
|
|
Secunia Advisory:
|
SA22806
|
|
|
Release Date:
|
2006-11-12
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Workaround
|
|
| Software: | MailMarshal for Exchange 5.x
MailMarshal SMTP 2006
MailMarshal SMTP 5.x
MailMarshal SMTP 6.x
|
| | CVE reference: | CVE-2006-5487 (Secunia mirror)
|
|
|
|
|
|
Description:
A vulnerability has been reported in MailMarshal SMTP and MailMarshal Exchange, which can be exploited by malicious people to compromise a vulnerable system.
An input validation error during the extraction and scanning of ARJ archives can be exploited to cause a file with a filename containing directory traversal modifiers to be extracted to an arbitrary directory on the system (e.g. the "All Users" startup folder).
Solution:
Users of MailMarshal SMTP should update to version 2006, release 6.1.8.
A fix is not currently available for MailMarshal Exchange, but will be included in the next service release. As a workaround, the vendor suggests creating a separate disk partition used only for MailMarshal unpacking folders.
Provided and/or discovered by:
Discovered by an anonymous person and reported via ZDI.
Original Advisory:
Marshal:
http://www.marshal.com/kb/article.aspx?id=11450
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-06-039.html
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
2 Related Secunia Security Advisories
|
|
|
1. MailMarshal tar Archive Directory Traversal
|
|
2. MailMarshal Spam Quarantine Management Interface Information Disclosure
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
|
|
Secunia PSI
Scan | Patch | Track
Free Download
|
|
|
Secunia Poll
|
|
|
|
|
 |
|
|
Most Popular Advisories
|
|
|
|
|
|
