National Cyber Awareness System

Vulnerability Summary for CVE-2005-3692

Overview

Cross-site scripting (XSS) vulnerability in AMAX Magic Winmail Server 4.2 (build 0824) and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) retid parameter in badlogin.php, (2) Content-Type headers in HTML mails, and (3) HTML mail attachments.

Impact

CVSS Severity (version 2.0 upgrade from v1.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VUPEN

Name: ADV-2005-2485

Hyperlink:http://www.vupen.com/english/advisories/2005/2485

External Source: BID

Name: 15493

Hyperlink:http://www.securityfocus.com/bid/15493

External Source: OSVDB

Name: 20928

Hyperlink:http://www.osvdb.org/20928

External Source: OSVDB

Name: 20927

Hyperlink:http://www.osvdb.org/20927

External Source: OSVDB

Name: 20926

Hyperlink:http://www.osvdb.org/20926

External Source: MISC

Name: http://secunia.com/secunia_research/2005-58/advisory/

Type: Advisory

Hyperlink:http://secunia.com/secunia_research/2005-58/advisory/

External Source: SECUNIA

Name: 16665

Type: Advisory

Hyperlink:http://secunia.com/advisories/16665

External Source: FULLDISC

Name: 20051118 Secunia Research: Winmail Server Multiple Vulnerabilities

Hyperlink:http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0580.html