IceWarp Web Mail Multiple Unspecified Remote Input Validation Vulnerabilities

Bugtraq ID:	11371
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 12 2004 12:00AM
Updated:	Oct 12 2004 12:00AM
Credit:	The individual responsible for the discovery of these issues is currently unknown.
Vulnerable:	IceWarp Web Mail 5.2.8 IceWarp Web Mail 5.2.7 IceWarp Web Mail 3.3.2
Not Vulnerable:	IceWarp Web Mail 5.3

IceWarp Web Mail Multiple Unspecified Remote Input Validation Vulnerabilities

Multiple unspecified remote input validation vulnerabilities reportedly affect IceWarp Web Mail. These issues are due to a failure of the application to validate or filter user-supplied input.

Although all the possible impacts of these issues are currently unknown, an attacker could leverage some to carry out cross-site scripting attacks, as well as create, move, modify and delete arbitrary server-readable files and directories. By exploiting these issues along with those outlined in BID 11611 (IceWarp Web Mail Multiple Remote Vulnerabilities) it may be possible to execute arbitrary server-side script code as well as other attacks.

IceWarp Web Mail Multiple Unspecified Remote Input Validation Vulnerabilities

No exploit is required to leverage these issues.

IceWarp Web Mail Multiple Unspecified Remote Input Validation Vulnerabilities

Solution:
The vendor has made an upgrade available resolving this issue.


IceWarp Web Mail 3.3.2

• IceWarp IceWarp Web Mail 5.3.0
  http://www.icewarp.com/Download/

IceWarp Web Mail 5.2.7

• IceWarp IceWarp Web Mail 5.3.0
  http://www.icewarp.com/Download/

IceWarp Web Mail 5.2.8

• IceWarp IceWarp Web Mail 5.3.0
  http://www.icewarp.com/Download/

IceWarp Web Mail Multiple Unspecified Remote Input Validation Vulnerabilities

References:

• IceWarp Homepage (IceWarp)
  
• IceWarp Web Mail For Windows 2003/2K/XP/NT/9x/ME Release notes. (IceWarp)
  
• Multiple vulnerabilities in Icewarp Web Mail 5.2.8 : New face of old problems. (ShineShadow )