Symantec Mail-Gear目录路径遍历漏洞-安全小百科

Symantec Mail-Gear目录路径遍历漏洞

漏洞ID	1105620	漏洞类型	其他
发布时间	1999-11-29	更新时间	2005-05-02
CVE编号	CVE-1999-0842	CNNVD-ID	CNNVD-199911-078
漏洞平台	Multiple	CVSS评分	5.0

|漏洞来源

https://www.exploit-db.com/exploits/19644
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199911-078

|漏洞详情

SymantecMail-Gear1.0web接口服务器存在漏洞。远程用户可以通过..(点点)攻击阅读任意文件。

|漏洞EXP

source: http://www.securityfocus.com/bid/827/info

Mail-Gear, a multi-purpose filtering email server, includes a webserver for remote administration and email retrieval. This webserver is vulnerable to the '../' directory traversal attack. By including the string '../' in the URL, remote attackers can gain read access to all files on the filesystem that the server has read access to. 


http: //target.host:8003/Display?what=../../../../../autoexec.bat
will display the server's autoexec.bat in a default NT installation.

|参考资料

来源:BUGTRAQ
名称:19991129SymantecMail-Gear1.0WebinterfaceServerDirectoryTraversalVulnerability
链接:http://www.securityfocus.com/templates/archive.pike?list=1&msg;[email protected]
来源:BID
名称:827
链接:http://www.securityfocus.com/bid/827
来源:OSVDB
名称:1144
链接:http://www.osvdb.org/1144

相关推荐: IceWarp Merak Mail Server Autoresp.HTML Unspecified Vulnerability

IceWarp Merak Mail Server Autoresp.HTML Unspecified Vulnerability 漏洞ID 1099627 漏洞类型 Input Validation Error 发布时间 2003-09-07 更新时间 20…

文章版权归作者所有，未经允许请勿转载。

THE END