mail_server 目录遍历漏洞

CVE编号

CVE-2006-0817

利用情况

暂无

补丁情况

N/A

披露时间

2006-07-22

漏洞描述

Absolute path directory traversal vulnerability in (a) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (b) VisNetic MailServer before 8.5.0.5 allows remote attackers to include arbitrary files via a full Windows path and drive letter in the (1) language parameter in accounts/inc/include.php and (2) lang_settings parameter in admin/inc/include.php, which is not properly sanitized by the securepath function, a related issue to CVE-2005-4556.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
http://secunia.com/advisories/18953
http://secunia.com/advisories/18966
http://secunia.com/secunia_research/2006-12/advisory/
http://secunia.com/secunia_research/2006-14/advisory/
http://securitytracker.com/id?1016513
http://securitytracker.com/id?1016514
http://www.osvdb.org/27328
http://www.securityfocus.com/archive/1/440297/100/0/threaded
http://www.securityfocus.com/archive/1/440302/100/0/threaded
http://www.securityfocus.com/bid/19002
http://www.securityfocus.com/bid/19007
http://www.vupen.com/english/advisories/2006/2825
http://www.vupen.com/english/advisories/2006/2826
https://exchange.xforce.ibmcloud.com/vulnerabilities/27773

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	deerfield	visnetic_mail_server	8.3.5	-
	运行在以下环境
	应用	icewarp	web_mail	5.6.0	-
	运行在以下环境
	应用	merak	mail_server	8.3.8r	-

CVSS3评分 5.0

• 攻击路径 网络
• 攻击复杂度 低
• 权限要求 无
• 影响范围 N/A
• 用户交互 无
• 可用性 无
• 保密性 无
• 完整性 部分地

AV:N/AC:L/Au:N/C:N/I:P/A:N CWE-ID 漏洞类型 NVD-CWE-Other