Sign-up

ID

VAR-200802-0085


CVE

CVE-2008-0946


TITLE

Ipswitch IM of IM Server Vulnerable to directory traversal

Trust: 0.8

sources: JVNDB: JVNDB-2008-004154

DESCRIPTION

Directory traversal vulnerability in the IM Server (aka IMserve or IMserver) in Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote authenticated users to create arbitrary empty files via a .. (dot dot) in the recipient field. Attackers can exploit these issues to execute arbitrary code, cause denial-of-service conditions, or overwrite files with arbitrary content. These issues affect Ipswitch Instant Messaging 2.0.8.1; other versions may also be affected. Remote authentication users can create arbitrary empty files with ".." in the message receiver field

Trust: 1.98

sources: NVD: CVE-2008-0946 // JVNDB: JVNDB-2008-004154 // BID: 27677 // VULHUB: VHN-31071

AFFECTED PRODUCTS

vendor:ipswitchmodel:imserverscope:lteversion:2.0.8.1

Trust: 1.8

vendor:ipswitchmodel:instant messagingscope:lteversion:2.0.8.1

Trust: 1.8

vendor:ipswitchmodel:instant messagingscope:eqversion:2.0.8.1

Trust: 0.9

vendor:ipswitchmodel:imserverscope:eqversion:2.0.8.1

Trust: 0.6

sources: BID: 27677 // JVNDB: JVNDB-2008-004154 // CNNVD: CNNVD-200802-454 // NVD: CVE-2008-0946

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2008-0946
value: MEDIUM

Trust: 1.0

NVD: CVE-2008-0946
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-200802-454
value: MEDIUM

Trust: 0.6

VULHUB: VHN-31071
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2008-0946
severity: MEDIUM
baseScore: 4.9
vectorString: AV:N/AC:M/AU:S/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-31071
severity: MEDIUM
baseScore: 4.9
vectorString: AV:N/AC:M/AU:S/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-31071 // JVNDB: JVNDB-2008-004154 // CNNVD: CNNVD-200802-454 // NVD: CVE-2008-0946

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.9

sources: VULHUB: VHN-31071 // JVNDB: JVNDB-2008-004154 // NVD: CVE-2008-0946

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200802-454

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-200802-454

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2008-004154

PATCH
title:Instant Messagingurl:http://www.imailserver.com/products/ipswitch-instant-messaging/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2008-004154

EXTERNAL IDS
db:NVDid:CVE-2008-0946
Trust: 2.8
db:BIDid:27677
Trust: 2.0
db:SREASONid:3697
Trust: 1.7
db:JVNDBid:JVNDB-2008-004154
Trust: 0.8
db:BUGTRAQid:20080207 MULTIPLE VULNERABILITIES IN IPSWITCH INSTANT MESSAGING 2.0.8.1
Trust: 0.6
db:CNNVDid:CNNVD-200802-454
Trust: 0.6
db:VULHUBid:VHN-31071
Trust: 0.1
sources:
            
            
            VULHUB: VHN-31071 // 
            
            
            
            BID: 27677 // 
            
            
            
            JVNDB: JVNDB-2008-004154 // 
            
            
            
            CNNVD: CNNVD-200802-454 // 
            
            
            
            NVD: CVE-2008-0946

REFERENCES
url:http://www.securityfocus.com/bid/27677
Trust: 1.7
url:http://aluigi.altervista.org/adv/ipsimene-adv.txt
Trust: 1.7
url:http://aluigi.org/poc/ipsimene.zip
Trust: 1.7
url:http://securityreason.com/securityalert/3697
Trust: 1.7
url:http://www.securityfocus.com/archive/1/487748/100/200/threaded
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-0946
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-0946
Trust: 0.8
url:http://www.securityfocus.com/archive/1/archive/1/487748/100/200/threaded
Trust: 0.6
url:http://www.ipswitch.com/products/instant_messaging
Trust: 0.3
url:/archive/1/487748
Trust: 0.3
sources:
            
            
            VULHUB: VHN-31071 // 
            
            
            
            BID: 27677 // 
            
            
            
            JVNDB: JVNDB-2008-004154 // 
            
            
            
            CNNVD: CNNVD-200802-454 // 
            
            
            
            NVD: CVE-2008-0946

CREDITS
Luigi Auriemma is credited with discovering these vulnerabilities.
Trust: 0.3
sources:
            
            
            BID: 27677

SOURCES
db:VULHUBid:VHN-31071
db:BIDid:27677
db:JVNDBid:JVNDB-2008-004154
db:CNNVDid:CNNVD-200802-454
db:NVDid:CVE-2008-0946

LAST UPDATE DATE
2025-04-10T22:57:19.877000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-31071date:2018-10-15T00:00:00
db:BIDid:27677date:2016-07-06T14:17:00
db:JVNDBid:JVNDB-2008-004154date:2012-09-25T00:00:00
db:CNNVDid:CNNVD-200802-454date:2008-09-05T00:00:00
db:NVDid:CVE-2008-0946date:2025-04-09T00:30:58.490

SOURCES RELEASE DATE
db:VULHUBid:VHN-31071date:2008-02-25T00:00:00
db:BIDid:27677date:2008-02-07T00:00:00
db:JVNDBid:JVNDB-2008-004154date:2012-09-25T00:00:00
db:CNNVDid:CNNVD-200802-454date:2008-02-25T00:00:00
db:NVDid:CVE-2008-0946date:2008-02-25T21:44:00