This host is running SmarterMail and is prone to directory traversal vulnerability.

Successful exploitation could allow remote authenticated users to read and write directories, files and perform malicious operations. Impact Level: Application

Upgrade to version 7.2.3925 or later. For updates refer to http://www.smartertools.com/smartermail/mail-server-software.aspx

The flaw is due to error in the 'FileStorageUpload.ashx', which fails to validate the input value passed to the 'name' parameter. This allows remote attackers to read arbitrary files via a '../' or '%5C' or '%255c' in the name parameter.

SmarterTools SmarterMail 7.1.3876

• http://packetstormsecurity.org/1009-exploits/smartermail-traversal.txt
• http://www.exploit-db.com/exploits/15048/
• http://xforce.iss.net/xforce/xfdb/61910

---

Updated on 2015-03-25