Open WebMail allows for unauthorized creation of directories
| open-webmail-directory-creation (15822) |  Medium Risk |
Description:
Open WebMail could allow a remote attacker to gain unauthorized access. If the 'use_syshomedir' option is disabled or the 'create_syshomedir' option is enabled, Open WebMail could allow a remote attacker to create arbitrary directories on the system.
Consequences:
File Manipulation
Remedy:
Upgrade to the latest CVS version of Open WebMail, available from the Open WebMail Web site. See References.
References:
- Open WebMail Web site: Index of /openwebmail/download.
- BID-10087: Open WebMail Arbitrary Directory Creation Vulnerability
- CVE-2004-2458: Open WebMail 2.30 and earlier, when use_syshomedir is disabled or create_syshomedir is enabled, creates new directories before authenticating, which allows remote attackers to create arbitrary directories.
- SA11334: Open WebMail Directory Creation Vulnerability
Platforms Affected:
- Open WebMail Project Open WebMail 2.30
Reported:
Apr 09, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net