CVE-2006-5487 Directory traversal vulnerability in Marshal MailMarshal SMTP 5.x, 6.x, and 2006, and MailMarshal for Exchange 5.x, allows remote attackers to write arbitrary files via ".." sequences in filenames in....
HighCVSS 10.0
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in Marshal MailMarshal SMTP 5.x, 6.x, and 2006, and MailMarshal for Exchange 5.x, allows remote attackers to write arbitrary files via ".." sequences in filenames in an ARJ compressed archive.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| marshal mailmarshal smtp | = 5.0 | No fix listed |
| marshal mailmarshal smtp | = 6.0 | No fix listed |
| marshal mailmarshal smtp | = 2006 | No fix listed |
References
- 22806 third-party-advisory vendor-advisory
- 1857 third-party-advisory
- 1017209 vdb-entry
- www.marshal.com patch
- 20061110 ZDI-06-039: Marshal MailMarshal ARJ Extraction Directory Traversal Vulnerability mailing-list
- 20999 vdb-entry
- ADV-2006-4457 vdb-entry
- www.zerodayinitiative.com patch vendor-advisory
- mailmarshal-arj-code-execution(30188) vdb-entry