OSVDB ID: 27590 Title: Symantec Brightmail AntiSpam DATABLOB-* Request Traversal Arbitrary File Write |
Info |
|
|
Dates |
||||
|
|
Description |
Symantec Brightmail AntiSpam contains a flaw that may allow a malicious user to read or overwrite files. The issue is triggered when an attacker uses specially crafted filenames in a DATABLOB-GET or DATABLOB-SAVE request. By using directory traversal style attacks (../../), it is possible that an attacker could write a file to an arbitrary location. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Confidentiality, Loss of Integrity Exploit: Exploit Unknown Disclosure: OSVDB Verified OSVDB: Security Software |
Solution |
Upgrade to version 6.0.4 or higher or upgrade to Symantec Mail Security for SMTP 5.0, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
|
tenablesecurity.com - TenableSecurity