MailScanner Clean()函数死循环漏洞

BUGTRAQ ID: 32514 MailScanner是邮件网关系统所使用的邮件安全和反垃圾邮件软件包。 MailScanner的Message.pm模块中的Clean函数存在安全漏洞。如果扫描到了特制的邮件消息的话，就可能触发死循环，导致耗尽大量CPU资源。 MailScanner 4 MailScanner ----------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.sng.ecs.soton.ac.uk/mailscanner...

CVE-2008-5140

trend-autoupdate.new in mailscanner 4.55.10 and other versions before 4.74.16-1 allows local users to overwrite arbitrary files via a symlink attack on a 1 /tmp/opr.ini. or 2 /tmp/lpt.zip temporary file...

Design/Logic Flaw

trend-autoupdate.new in mailscanner 4.55.10 and other versions before 4.74.16-1 allows local users to overwrite arbitrary files via a symlink attack on a 1 /tmp/opr.ini. or 2 /tmp/lpt.zip temporary file...

CVE-2008-5140

trend-autoupdate.new in mailscanner 4.55.10 and other versions before 4.74.16-1 allows local users to overwrite arbitrary files via a symlink attack on a 1 /tmp/opr.ini. or 2 /tmp/lpt.zip temporary file...

CVE-2008-5140

CVE-2008-5140 : MailScanner 4.55.10 and other versions before 4.74.16-1 are vulnerable to local user symlink attacks that can overwrite arbitrary files via temporary files such as /tmp/opr.ini.##### and /tmp/lpt*.zip, exposing a local-privilege risk. The underlying issue is a symlink-based overwr...

CVE-2008-5140

trend-autoupdate.new in mailscanner 4.55.10 and other versions before 4.74.16-1 allows local users to overwrite arbitrary files via a symlink attack on a 1 /tmp/opr.ini. or 2 /tmp/lpt.zip temporary file...

CVE-2008-5140: Improper Link Resolution Before File Access

trend-autoupdate.new in mailscanner 4.55.10 and other versions before 4.74.16-1 allows local users to overwrite arbitrary files via a symlink attack on a 1 /tmp/opr.ini. or 2 /tmp/lpt.zip temporary file...

MailWatch for MailScanner mailscanner/docs.php doc Parameter Traversal Local File Inclusion

The remote host is running MailWatch for MailScanner, a web-based front-end to MailScanner written in PHP. The version of MailWatch for MailScanner installed on the remote host fails to sanitize user-supplied input to the 'doc' parameter of the 'docs.php' script before using it to include PHP cod...

mailwatch 1.0.4 - doc Local File Inclusion

mailwatch 1.0.4 - doc Local File Inclusion :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl mailwatch \n"; echo " \n"; echo " \n"; echo " Documentation\n"; echo " This page does no...

mailwatch 1.0.4 - 'doc' Local File Inclusion

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl mailwatch \n"; echo " \n"; echo " \n"; echo " Documentation\n"; echo " This page does not require authentication, so you can put...

CVE-2002-2228

CVE-2002-2228 affects MailScanner prior to 4.0 5-1 and prior to 3.2 6-1. The vulnerability allows remote attackers to bypass protection by crafting attachments whose filenames contain (1) extra leading spaces, (2) extra trailing spaces, or (3) alternate character encodings that MailScanner cannot...

CVE-2002-2228

MailScanner before 4.0 5-1 and before 3.2 6-1 allows remote attackers to bypass protection via attachments with a filename with 1 extra leading spaces, 2 extra trailing spaces, or 3 alternate character encodings that cannot be processed by MailScanner...

CVE-2002-2228: Improper Input Validation

MailScanner before 4.0 5-1 and before 3.2 6-1 allows remote attackers to bypass protection via attachments with a filename with 1 extra leading spaces, 2 extra trailing spaces, or 3 alternate character encodings that cannot be processed by MailScanner...

CVE-2005-3470

SQL injection vulnerability in in the authenticate function in MailWatch for MailScanner 1.0.2 allows remote attackers to execute arbitrary SQL commands...

CVE-2005-3471

Directory traversal vulnerability in the ruleset view for MailWatch for MailScanner 1.0.2 allows remote attackers to access arbitrary files...

CVE-2005-3471

Directory traversal vulnerability in the ruleset view for MailWatch for MailScanner 1.0.2 allows remote attackers to access arbitrary files...

CVE-2005-3470

SQL injection vulnerability in in the authenticate function in MailWatch for MailScanner 1.0.2 allows remote attackers to execute arbitrary SQL commands...

CVE-2005-3470

MailWatch authenticate() Function SQL Injection (CVE-2005-3470) affects MailWatch for MailScanner 1.0.2. The Nessus entry notes the authentication() function in functions.php fails to sanitize inputs, enabling remote SQL injection to bypass authentication and gain administrative access. This is a...

CVE-2005-3471

CVE-2005-3471 describes a directory traversal vulnerability in the ruleset view of MailWatch for MailScanner 1.0.2, allowing remote attackers to access arbitrary files. The vulnerability stems from improper validation in the ruleset view, enabling an attacker to traverse the file system. The affe...

CVE-2005-3470: Undefined Security Weakness

SQL injection vulnerability in in the authenticate function in MailWatch for MailScanner 1.0.2 allows remote attackers to execute arbitrary SQL commands...