VisNetic / Merak Mail Server Multiple Remote Vulnerabilities

high Nessus Plugin ID 20346

Language:

Synopsis

The remote webmail server is affected by multiple vulnerabilities that could allow an attacker to execute arbitrary commands on the remote host.

Description

The remote host is running VisNetic / Merak Mail Server, a multi- featured mail server for Windows.

The webmail and webadmin services included in the remote version of this software are prone to multiple flaws. An attacker could send specially crafted URLs to execute arbitrary scripts, perhaps taken from third-party hosts, or to disclose the content of files on the remote system.

Solution

Upgrade to Merak Mail Server 8.3.5.r / VisNetic Mail Server version 8.3.5 or later.

Plugin Details

Severity: High

ID: 20346

File Name: visnetic_mailserver_flaws.nasl

Version: 1.20

Type: remote

Family: CGI abuses

Published: 12/28/2005

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2005-4556

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Required KB Items: www/PHP

Exploit Ease: No exploit is required

Vulnerability Publication Date: 12/27/2005

Reference Information

CVE: CVE-2005-4556, CVE-2005-4557, CVE-2005-4558, CVE-2005-4559

BID: 16069

Detections

Analytics