search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Majordomo 2 _list_file_get() directory traversal vulnerability

Vulnerability Note VU#363726

Original Release Date: 2011-02-04 | Last Revised: 2011-03-28

Overview

Majordomo 2 contains a directory traversal vulnerability in the _list_file_get()function, which may allow a remote, unauthenticated attacker to obtain sensitive information.

Description

Majordomo 2 contains a directory traversal vulnerability in the _list_file_get()function (lib/Majordomo.pm) caused by an input validation error when handling files. An attacker can exploit this vulnerability via directory traversal specifiers sent in a specially crafted request to any of the application's interfaces (e.g. email or web).

Additional information regarding this vulnerability can be found in this Sitewatch Advisory.

Impact

A remote unauthenticated attacker could obtain sensitive information.

Solution

Update
Majordomo 2 recommends users update to snapshot 20110204 or later.

Vendor Information

The vulnerability is reported in snapshots prior to 20110204.

363726
 
Affected   Unknown   Unaffected

Majordomo 2

Updated:  February 04, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Acknowledgements

This vulnerability was reported by Michael Brooks.

This document was written by Michael Orlando.

Other Information

CVE IDs: CVE-2011-0049
Severity Metric: 25.20
Date Public: 2011-02-04
Date First Published: 2011-02-04
Date Last Updated: 2011-03-28 12:27 UTC
Document Revision: 21

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.