----------------------------------------------------------------------


Proof-of-Concept (PoC) and Extended Analysis available for customers.

Get a free trial, contact sales@secunia.com


----------------------------------------------------------------------

TITLE:
MDaemon Mailing List Subscription Directory Traversal

SECUNIA ADVISORY ID:
SA39672

VERIFY ADVISORY:
http://secunia.com/advisories/39672/

DESCRIPTION:
Kingcope has discovered a security issue in MDaemon, which
potentially can be exploited by malicious people to disclose
sensitive information.

The security issue is caused due to an input sanitation error when
processing mailing list subscription requests. This can be exploited
to disclose an arbitrary local text file via an e-mail sent to the
"MDaemon" account, containing "SUBSCRIBE" followed by directory
traversal sequences in the subject.

Successful exploitation requires that a malicious ".grp" file is
placed at a known location on the local system.

The security issue is confirmed in version 11.0.1. Other versions may
also be affected.

SOLUTION:
Reject subscription messages received from untrusted sources.

PROVIDED AND/OR DISCOVERED BY:
Kingcope

ORIGINAL ADVISORY:
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0010.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------