CVE-2006-0817
First published: Tue Jul 18 2006(Updated: )
Absolute path directory traversal vulnerability in (a) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (b) VisNetic MailServer before 8.5.0.5 allows remote attackers to include arbitrary files via a full Windows path and drive letter in the (1) language parameter in accounts/inc/include.php and (2) lang_settings parameter in admin/inc/include.php, which is not properly sanitized by the securepath function, a related issue to CVE-2005-4556.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Merak Mail Server | =8.3.8r | |
| Deerfield Visnetic Mail Server | =8.3.5 | |
| IceWarp Web Mail | =5.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/secunia_research/2006-12/advisory/
- http://secunia.com/secunia_research/2006-14/advisory/
- http://www.securityfocus.com/bid/19002
- http://secunia.com/advisories/18953
- http://secunia.com/advisories/18966
- http://securitytracker.com/id?1016513
- http://securitytracker.com/id?1016514
- http://www.osvdb.org/27328
- http://www.vupen.com/english/advisories/2006/2825
- http://www.securityfocus.com/bid/19007
- http://www.vupen.com/english/advisories/2006/2826
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27773
- http://www.securityfocus.com/archive/1/440302/100/0/threaded
- http://www.securityfocus.com/archive/1/440297/100/0/threaded
- collector/nvd-historical
- collector/nvd-index
- agent/references
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- vendor/merak
- canonical/merak mail server
- version/merak mail server/8.3.8r
- vendor/deerfield
- canonical/deerfield visnetic mail server
- version/deerfield visnetic mail server/8.3.5
- vendor/icewarp
- canonical/icewarp web mail
- version/icewarp web mail/5.6.0