CVE-2008-0946: Path Traversal

Q: What is the severity of CVE-2008-0946?

CVE-2008-0946 has a high severity due to its ability to allow remote authenticated users to exploit directory traversal vulnerabilities.

Q: How do I fix CVE-2008-0946?

To fix CVE-2008-0946, upgrade to a version of Ipswitch Instant Messaging greater than 2.0.8.1.

Q: Who is affected by CVE-2008-0946?

CVE-2008-0946 affects users of Ipswitch Instant Messaging versions 2.0.8.1 and earlier.

Q: What kind of attack can be executed due to CVE-2008-0946?

CVE-2008-0946 allows authenticated attackers to create arbitrary empty files on the server.

Q: Is CVE-2008-0946 exploitable without authentication?

CVE-2008-0946 is not exploitable without authentication, as it requires remote authenticated user privileges.

Published Feb 25, 2008

Updated

Directory traversal vulnerability in the IM Server (aka IMserve or IMserver) in Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote authenticated users to create arbitrary empty files via a .. (dot dot) in the recipient field.

Affected Software

2 affected components

Ipswitch IMserver<=2.0.8.1

Ipswitch Instant Messaging<=2.0.8.1

Event History

Feb 25, 2008

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-0946?

CVE-2008-0946 has a high severity due to its ability to allow remote authenticated users to exploit directory traversal vulnerabilities.

How do I fix CVE-2008-0946?

To fix CVE-2008-0946, upgrade to a version of Ipswitch Instant Messaging greater than 2.0.8.1.

Who is affected by CVE-2008-0946?

CVE-2008-0946 affects users of Ipswitch Instant Messaging versions 2.0.8.1 and earlier.

What kind of attack can be executed due to CVE-2008-0946?

CVE-2008-0946 allows authenticated attackers to create arbitrary empty files on the server.

Is CVE-2008-0946 exploitable without authentication?