KLA10399 Multiple vulnerabilities in Winmail

Multiple serious vulnerabilities have been found in Winmail Server. Malicious users can exploit these vulnerabilities to inject scripts or overwrite local files. Below is a complete list of vulnerabilities

1. A directory traversal can be exploited remotely via a side parameter;
2. An XSS vulnerability can be exploited remotely via a retid parameter or specially designed e-mail messages.

Original advisories

Related products

Winmail-Server

CVE list

CVE-2005-3811 critical

CVE-2005-3692 warning

Solution

Update to latest version

Impacts

• CI

Code injection. Exploitation of vulnerabilities with this impact can lead to changes in target code.

• WLF

Write Local Files. Exploitation of vulnerabilities with this impact can lead to writing into some inaccessible files. Files that can be read depends on concrete program errors.

Affected Products

• AMAX Magic Winmail Server versions 4.2 and earlier