Anti-Spam SMTP Proxy Server Unauthorized File Access Vulnerability

Bugtraq ID:	19545
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 16 2006 12:00AM
Updated:	Aug 17 2006 12:25AM
Credit:	Micheal Espinola Jr. has been credited with the discovery of this vulnerability.
Vulnerable:	John Hanna Anti-Spam SMTP Proxy (ASSP) Server 1.2.3
Not Vulnerable:

Anti-Spam SMTP Proxy Server Unauthorized File Access Vulnerability

Anti-Spam SMTP Proxy Server is prone to a vulnerability that can allow attackers to gain unauthorized access to files that may contain sensitive information.

An attacker may exploit this issue to access any file on the server or on a mapped drive. Information obtained may aid in other attacks against a vulnerable computer.

Version 1.2.3 is vulnerable to this issue; other versions may also be affected.

To exploit this issue, an attacker must have authenticated access to the affected system.

Anti-Spam SMTP Proxy Server Unauthorized File Access Vulnerability

Attackers can exploit this issue via a web client.

Anti-Spam SMTP Proxy Server Unauthorized File Access Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Anti-Spam SMTP Proxy Server Unauthorized File Access Vulnerability

References:

• Anti-Spam SMTP Proxy Server Home Page (John Hanna)