| VID |
18063 |
| Severity |
30 |
| Port |
143 |
| Protocol |
TCP |
| Class |
IMAP |
| Detailed Description |
The UW IMAP(wu-imapd) allows a remote attacker to retrieve arbitrary file on the server.
UW IMAP (wu-imapd) is an Internet Message Access Protocol (IMAP) daemon developed by the University of Washington. Several versions of UW IMAP have the feature enabled by default that allows users to view files via the IMAP daemon. Due to this improper feature, if a malicious attacker are not authorized shell access to a system, but have a valid account from which to download mail via IMAP, the attacker could view arbitrary files on the system.
* Note: This check requires the username and password that can log in to the remote IMAP server to scan.
* References:
http://archives.neohapsis.com/archives/bugtraq/2002-05/0295.html
http://www.washington.edu/imap/IMAP-FAQs/index.html#5.1
* Platforms Affected:
Washington University UW IMAP(wu-imapd) Any version
Linux Any version
Unix Any version |
| Recommendation |
No upgrade of patch for this vulnerability as of June 2014. Contact your vendor for a fix.
As a workaround, you can choice one of three ways as listed the following IMAP FAQ 5.1 to disable arbitrary file access. Note that these choices reduce IMAP functionality, and may have undesirable side effects.
1. http://www.washington.edu/imap/documentation/CONFIG.html
2. http://www.washington.edu/imap/IMAP-FAQs/index.html#5.1 |
| Related URL |
CVE-2002-1782 (CVE) |
| Related URL |
4909 (SecurityFocus) |
| Related URL |
9238 (ISS) |
|
