Nessus Plugin #16042

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

Winmail Mail Server Information Disclosure

Family:

CGI abuses

Category:

attack

Copyright:

This script is Copyright (C) 2004 Noam Rathaus

Summary:

Checks for the presence of an Information Disclosure in Winmail Mail Server

Version:

$Revision: 1.1 $

Cve_id:

-

Bugtraq_id:

-

Xrefs:

OSVDB:12336, OSVDB:12337, OSVDB:12338

Description:

The remote host is running Winmail Server.

Winmail Server is an enterprise class mail server software system
offering a robust feature set, including extensive security
measures. Winmail Server supports SMTP, POP3, IMAP, Webmail, LDAP,
multiple domains, SMTP authentication, spam protection, anti-virus
protection, SSL/TLS security, Network Storage, remote access,
Web-based administration, and a wide array of standard email options
such as filtering, signatures, real-time monitoring, archiving,
and public email folders.

Three scripts that come with the program (chgpwd.php, domain.php and user.php)
allow a remote attacker to disclose sensitive information about the remote host.

Solution : Upgrade to the latest version of this software
Risk factor : Medium