[VulnWatch] Multiple Vulnerabilities Found in Mailtraq (DoS, Password Decryption, Directory Traversal)

From: SecurITeam BugTraq Monitoring (bugtraq_at_securiteam.com)
Date: 06/16/03

  • Next message: SecuriTeam: "[UNIX] BNC Double File Locking Mechanism Allows Attackers to Cause a Denial of Service" 
    To: <vulnwatch@vulnwatch.org>
Date: Mon, 16 Jun 2003 11:31:27 +0200

    Summary:
    Mailtraq is a "comprehensive e-mail SMTP/POP3 and proxy server, with a powerful
    mailing list server". The product suffeed from multiple vulnerabilities that
    range from access to files that reside outside the bounding HTML root directory
    (through dnying access to the server by causing the server to utilize a high CPU
    percentage) through decryption of locally stored password, to a cross site
    scripting vulnerability in the web mail interface.

    Vulnerable version:
     * Mailtraq version 2.1.0.1302

    Immune version:
     * Mailtraq version 2.3.2.1419

    For the complete advisory see:
    http://www.securiteam.com/windowsntfocus/5HP0G1FAAC.html

    Thanks
    SecurITeam
    http://www.SecurITeam.com
    http://www.BeyondSecurity.com

  • Next message: SecuriTeam: "[UNIX] BNC Double File Locking Mechanism Allows Attackers to Cause a Denial of Service"

    Relevant Pages