BID:6148

MailScanner Attachment Filename Validation Vulnerability

Info

MailScanner Attachment Filename Validation Vulnerability

Bugtraq ID:	6148
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 09 2002 12:00AM
Updated:	Nov 09 2002 12:00AM
Credit:	This issue was reported by the vendor.
Vulnerable:	MailScanner MailScanner 4.0 4-1 MailScanner MailScanner 4.0 3-1 MailScanner MailScanner 4.0 2-3 MailScanner MailScanner 4.0 2-2 MailScanner MailScanner 4.0 2-1 MailScanner MailScanner 3.2 5-1 MailScanner MailScanner 3.2 4-1 MailScanner MailScanner 3.2 3-5 MailScanner MailScanner 3.2 3-4 MailScanner MailScanner 3.2 3-3 MailScanner MailScanner 3.2 3-2 MailScanner MailScanner 3.2 3-1

Not Vulnerable:	MailScanner MailScanner 4.0 5-3 MailScanner MailScanner 4.0 5-2 MailScanner MailScanner 4.0 5-1 MailScanner MailScanner 3.2 6-2 MailScanner MailScanner 3.2 6-1

Discussion

MailScanner Attachment Filename Validation Vulnerability

A vulnerability has been reported in how MailScanner handles filenames for attachments.

It may be possible to bypass MailScanner security with attachment filenames that contain excessive trailing/leading whitespace, are blank, or use character encodings that are unknown to MailScanner.

The exact consequences of this vulnerability are not known.

Exploit / POC

MailScanner Attachment Filename Validation Vulnerability

There is no exploit code required.

Solution / Fix

MailScanner Attachment Filename Validation Vulnerability

Solution:
The vendor has released updates which address this issue.

MailScanner MailScanner 3.2 3-1