Sign-up

ID

VAR-201207-0459


CVE

CVE-2012-2202


TITLE

IBM ISS Proventia Mail Security contains multiple vulnerabilities

Trust: 0.8

sources: CERT/CC: VU#659791

DESCRIPTION

Directory traversal vulnerability in javatester_init.php in IBM Lotus Protector for Mail Security 2.1, 2.5, 2.5.1, and 2.8 and IBM ISS Proventia Network Mail Security System allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the template parameter. An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Remote authentication users can use this vulnerability to read arbitrary files through .. ---------------------------------------------------------------------- We are millions! Join us to protect all Pc's Worldwide. Download the new Secunia PSI 3.0 available in 5 languages and share it with your friends: http://secunia.com/psi ---------------------------------------------------------------------- TITLE: IBM Lotus Protector for Mail Security Information Disclosure Weakness SECUNIA ADVISORY ID: SA49897 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49897/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49897 RELEASE DATE: 2012-07-17 DISCUSS ADVISORY: http://secunia.com/advisories/49897/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/49897/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=49897 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A weakness has been reported in IBM Lotus Protector for Mail Security, which can be exploited by malicious users to disclose potentially sensitive information. Certain input to the management interface is not properly verified before being used to display files. This can be exploited to disclose the contents of arbitrary files. Successful exploitation requires access to the administrative user interface (UI). The weakness is reported in versions 2.5, 2.5.1, and 2.8. SOLUTION: Apply updates (please see the vendor's advisory for details). PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: IBM: http://www.ibm.com/support/docview.wss?uid=swg21605199 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.79

sources: NVD: CVE-2012-2202 // CERT/CC: VU#659791 // JVNDB: JVNDB-2012-003414 // BID: 54486 // VULHUB: VHN-55483 // PACKETSTORM: 114816

AFFECTED PRODUCTS

vendor:ibmmodel:proventia network mail security systemscope: - version: -

Trust: 1.6

vendor:ibmmodel:lotus protector for mail securityscope:eqversion:2.5.1

Trust: 1.6

vendor:ibmmodel:proventia network mail security systemscope:eqversion:2.6

Trust: 1.6

vendor:ibmmodel:lotus protector for mail securityscope:eqversion:2.8

Trust: 1.6

vendor:ibmmodel:lotus protector for mail securityscope:eqversion:2.1

Trust: 1.6

vendor:ibmmodel:proventia network mail security systemscope:eqversion:2.5

Trust: 1.6

vendor:ibmmodel:proventia network mail security systemscope:eqversion:2.5.1

Trust: 1.6

vendor:ibmmodel:lotus protector for mail securityscope:eqversion:2.5

Trust: 1.6

vendor:ibmmodel:proventia network mail security systemscope:eqversion:2.8

Trust: 1.6

vendor:ibmmodel:proventia network mail security systemscope:eqversion:2.5.0.2

Trust: 1.6

vendor:ibmmodel: - scope: - version: -

Trust: 0.8

vendor:ibmmodel:lotus protector for mail securityscope: - version: -

Trust: 0.8

sources: CERT/CC: VU#659791 // JVNDB: JVNDB-2012-003414 // CNNVD: CNNVD-201207-577 // NVD: CVE-2012-2202

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-2202
value: LOW

Trust: 1.0

NVD: CVE-2012-2202
value: LOW

Trust: 0.8

CNNVD: CNNVD-201207-577
value: LOW

Trust: 0.6

VULHUB: VHN-55483
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2012-2202
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-55483
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-55483 // JVNDB: JVNDB-2012-003414 // CNNVD: CNNVD-201207-577 // NVD: CVE-2012-2202

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.9

sources: VULHUB: VHN-55483 // JVNDB: JVNDB-2012-003414 // NVD: CVE-2012-2202

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201207-577

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-201207-577

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2012-003414

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-55483

PATCH
title:1605630url:http://www-01.ibm.com/support/docview.wss?uid=swg21605630
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2012-003414

EXTERNAL IDS
db:NVDid:CVE-2012-2202
Trust: 2.8
db:CERT/CCid:VU#659791
Trust: 2.7
db:SECUNIAid:49897
Trust: 1.2
db:JVNDBid:JVNDB-2012-003414
Trust: 0.8
db:CNNVDid:CNNVD-201207-577
Trust: 0.7
db:XFid:76801
Trust: 0.6
db:BIDid:54486
Trust: 0.3
db:SEEBUGid:SSVID-74249
Trust: 0.1
db:EXPLOIT-DBid:20368
Trust: 0.1
db:VULHUBid:VHN-55483
Trust: 0.1
db:PACKETSTORMid:114816
Trust: 0.1
sources:
            
            
            CERT/CC: VU#659791 // 
            
            
            
            VULHUB: VHN-55483 // 
            
            
            
            BID: 54486 // 
            
            
            
            JVNDB: JVNDB-2012-003414 // 
            
            
            
            PACKETSTORM: 114816 // 
            
            
            
            CNNVD: CNNVD-201207-577 // 
            
            
            
            NVD: CVE-2012-2202

REFERENCES
url:http://www-01.ibm.com/support/docview.wss?uid=swg21605630
Trust: 3.3
url:http://www.kb.cert.org/vuls/id/659791
Trust: 1.9
url:http://secunia.com/advisories/49897
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/76801
Trust: 1.1
url:http://www-01.ibm.com/support/docview.wss?uid=swg21605626
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2202
Trust: 0.8
url:http://jvn.jp/cert/jvnvu659791
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-2202
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/76801
Trust: 0.6
url:http://secunia.com/psi
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://www.ibm.com/support/docview.wss?uid=swg21605199
Trust: 0.1
url:http://secunia.com/advisories/49897/#comments
Trust: 0.1
url:http://secunia.com/advisories/49897/
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=49897
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            CERT/CC: VU#659791 // 
            
            
            
            VULHUB: VHN-55483 // 
            
            
            
            JVNDB: JVNDB-2012-003414 // 
            
            
            
            PACKETSTORM: 114816 // 
            
            
            
            CNNVD: CNNVD-201207-577 // 
            
            
            
            NVD: CVE-2012-2202

CREDITS
Reported by the vendor.
Trust: 0.3
sources:
            
            
            BID: 54486

SOURCES
db:CERT/CCid:VU#659791
db:VULHUBid:VHN-55483
db:BIDid:54486
db:JVNDBid:JVNDB-2012-003414
db:PACKETSTORMid:114816
db:CNNVDid:CNNVD-201207-577
db:NVDid:CVE-2012-2202

LAST UPDATE DATE
2025-04-11T22:53:40.167000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#659791date:2012-07-25T00:00:00
db:VULHUBid:VHN-55483date:2017-12-22T00:00:00
db:BIDid:54486date:2012-08-08T18:52:00
db:JVNDBid:JVNDB-2012-003414date:2012-07-30T00:00:00
db:CNNVDid:CNNVD-201207-577date:2012-07-30T00:00:00
db:NVDid:CVE-2012-2202date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:CERT/CCid:VU#659791date:2012-07-25T00:00:00
db:VULHUBid:VHN-55483date:2012-07-27T00:00:00
db:BIDid:54486date:2012-07-17T00:00:00
db:JVNDBid:JVNDB-2012-003414date:2012-07-30T00:00:00
db:PACKETSTORMid:114816date:2012-07-17T02:48:11
db:CNNVDid:CNNVD-201207-577date:2012-07-30T00:00:00
db:NVDid:CVE-2012-2202date:2012-07-27T10:27:49.043