Sympa CVE-2015-1306 File Disclosure Vulnerability

Bugtraq ID:	72277
Class:	Input Validation Error
CVE:	CVE-2015-1306
Remote:	Yes
Local:	No
Published:	Jan 22 2015 12:00AM
Updated:	Mar 08 2015 04:09PM
Credit:	The vendor reported this issue.
Vulnerable:	Sympa Sympa 6.1.10 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	Sympa Sympa 6.1.11

Sympa CVE-2015-1306 File Disclosure Vulnerability

Sympa is prone to a file-disclosure vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to gain access to sensitive information stored in arbitrary files, that may aid in further attacks.

Sympa CVE-2015-1306 File Disclosure Vulnerability

Attackers can use readily available network tools to exploit this issue.

Sympa CVE-2015-1306 File Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Mandriva Business Server 1 X86 64

• Mandriva sympa-6.1.17-1.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva sympa-www-6.1.17-1.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/

Sympa CVE-2015-1306 File Disclosure Vulnerability

References:

• 2012-001 Security breaches in archives management (Sympa)
  
• Sympa Home Page (Sympa)