Ventia DeskNow Mail And Collaboration Server多个远程目录遍历漏洞

漏洞信息详情

Ventia DeskNow Mail And Collaboration Server多个远程目录遍历漏洞

CNNVD编号：CNNVD-200505-638
危害等级：高危-->
危害等级：高危
CVE编号： CVE-2005-0332
漏洞类型：路径遍历
发布时间： 2005-05-02
威胁类型：远程
更新时间： 2006-06-15
厂商： ventia
漏洞来源： Tan Chew Keong is ...

漏洞简介

DeskNow Mail和Collaboration Server 2.5.12存在目录遍历漏洞，远程攻击者可以(1)通过传到attachment.do的AttachmentsKey参数上载并可能执行目录之外的文件，如使用JSP页，或(2)通过传到file.do的select_file参数删除任意文件。

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接： Ventia DeskNow Mail and Collaboration Server 2.5.12 Ventia Mail and Collaboration Server 2.5.14 http://www.desknow.com/desknowmc/index.html Ventia DeskNow Mail and Collaboration Server 2.5.13 Ventia Mail and Collaboration Server 2.5.14 http://www.desknow.com/desknowmc/index.html

参考网址

来源: XF 名称: desknow-jsp-gain-access(19211) 链接:http://xforce.iss.net/xforce/xfdb/19211 来源: XF 名称: desknow-attachmentkey-file-upload(19206) 链接:http://xforce.iss.net/xforce/xfdb/19206 来源: BID 名称: 12421 链接:http://www.securityfocus.com/bid/12421 来源: XF 名称: desknow-filedo-file-deletion(19212) 链接:http://xforce.iss.net/xforce/xfdb/19212 来源: MISC 链接:http://www.security.org.sg/vuln/desknow2512.html 来源: SECTRACK 名称: 1013060 链接:http://securitytracker.com/id?1013060 来源: SECUNIA 名称: 14116 链接:http://secunia.com/advisories/14116 来源: BUGTRAQ 名称: 20050202 [SIG^2 G-TEC] DeskNow Mail and Collaboration Server Directory Traversal Vulnerabilities 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=110737616324614&w=2

受影响实体

Ventia Desknow_mail_and_collaboration_server:2.5.12
Ventia Desknow_mail_and_collaboration_server:2.5.13

补丁

暂无

正文

Ventia DeskNow Mail And Collaboration Server多个远程目录遍历漏洞

漏洞信息详情