CVE-2005-4557 dir/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, allows remote attackers to include arbitrary local files via a null byte...
MediumCVSS 5.0
EPSS 9.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
dir/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, allows remote attackers to include arbitrary local files via a null byte (%00) in the lang parameter, possibly due to a directory traversal vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| deerfield visnetic mail server | = 8.3.0_build1 | No fix listed |
| icewarp web mail | = 5.5.1 | No fix listed |
| merak mail server | = 8.3.0r | No fix listed |
References
- 20051227 Secunia Research: IceWarp Web Mail Multiple File mailing-list
- 17046 exploit patch third-party-advisory vendor-advisory
- 17865 third-party-advisory
- secunia.com exploit vendor-advisory
- 1015412 vdb-entry
- 22079 vdb-entry
- 20051227 Secunia Research: IceWarp Web Mail Multiple File InclusionVulnerabilities mailing-list
- 16069 exploit vdb-entry
- visnetic-scripts-file-include(23897) vdb-entry