[Full-Disclosure] Multiple Vulnerabilities Found in Mailtraq (DoS, Password Decryption, Directory Traversal)

From: SecurITeam BugTraq Monitoring (bugtraq_at_securiteam.com)
Date: 06/16/03

  • Next message: morning_wood: "[Full-Disclosure] Asp Chat - .ASP XSS / JS Injection" 
    To: <full-disclosure@lists.netsys.com>
Date: Mon, 16 Jun 2003 11:31:21 +0200

    Summary:
    Mailtraq is a "comprehensive e-mail SMTP/POP3 and proxy server, with a powerful
    mailing list server". The product suffeed from multiple vulnerabilities that
    range from access to files that reside outside the bounding HTML root directory
    (through dnying access to the server by causing the server to utilize a high CPU
    percentage) through decryption of locally stored password, to a cross site
    scripting vulnerability in the web mail interface.

    Vulnerable version:
     * Mailtraq version 2.1.0.1302

    Immune version:
     * Mailtraq version 2.3.2.1419

    For the complete advisory see:
    http://www.securiteam.com/windowsntfocus/5HP0G1FAAC.html

    Thanks
    SecurITeam
    http://www.SecurITeam.com
    http://www.BeyondSecurity.com

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: morning_wood: "[Full-Disclosure] Asp Chat - .ASP XSS / JS Injection"

    Relevant Pages