BID:6740

IlohaMail Arbitrary File Attachment Upload Path Vulnerability

Info

IlohaMail Arbitrary File Attachment Upload Path Vulnerability

Bugtraq ID:	6740
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 28 2003 12:00AM
Updated:	Jan 28 2003 12:00AM
Credit:	This issue was announced in the product changelog.
Vulnerable:	IlohaMail IlohaMail 0.7.8 IlohaMail IlohaMail 0.7.7 IlohaMail IlohaMail 0.7.6 IlohaMail IlohaMail 0.7.5 IlohaMail IlohaMail 0.7.4 -2 IlohaMail IlohaMail 0.7.4 IlohaMail IlohaMail 0.7.3 IlohaMail IlohaMail 0.7.2 IlohaMail IlohaMail 0.7.1 IlohaMail IlohaMail 0.7 .0

Not Vulnerable:	IlohaMail IlohaMail 0.7.9

Discussion

IlohaMail Arbitrary File Attachment Upload Path Vulnerability

Vulnerable versions of IlohaMail do not sufficiently check the upload path for file attachments when a message is composed. As a result, a malicious user of the webmail system may be able to place a file on the host in any location which is writeable by the webserver process. It is also possible that local files may be overwritten by the malicious file attachment.

Exploit / POC

IlohaMail Arbitrary File Attachment Upload Path Vulnerability

There is no exploit required.

Solution / Fix

IlohaMail Arbitrary File Attachment Upload Path Vulnerability

Solution:
This issue has been addressed in IlohaMail 0.7.9.

IlohaMail IlohaMail 0.7 .0