CVE-2006-0448 Path traversal in n/a
Remote attackers can traverse directories to list files, create arbitrary files, or cause denial of service in E-Post Mail IMAP services.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-0448?
CVE-2006-0448 is a high-severity path traversal vulnerability in n/a, published on 27 Jan 2006. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Multiple directory traversal vulnerabilities in (1) EPSTIMAP4S.EXE and (2) SPA-IMAP4S.EXE in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allow remote attackers to (a) list arbitrary directories or cause a denial of service via the LIST command; or create arbitrary files via the (b) APPEND, (c) COPY, or (d) RENAME commands.
Which versions are affected by CVE-2006-0448?
It affects 2 products.
Products include E-Post Corporation Mail Server, E-Post Corporation Spa-Pro Mail Atsolomon.
How do I fix CVE-2006-0448?
No fix has been published for CVE-2006-0448 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2006-0448 being exploited?
There is no known exploitation of CVE-2006-0448 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-pggj-5fr4-883m.