CVE-2005-4559

published 2005-12-28

CVE-2005-4559: mail/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly initialize…

Priority P2 70 medium 5 CVSS 2.0

AV N AC L Au N C P I N A N

ITW EXPLOIT VulnCheck KEV

mail/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly initialize the default_layout and layout_settings variables when an unrecognized HTTP_USER_AGENT string is provided, which allows remote attackers to access arbitrary files via a request with an unrecognized User Agent that also specifies the desired default_layout and layout_settings parameters.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
deerfield	visnetic_mail_server	—	—
icewarp	web_mail	—	—
merak	mail_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /mail/include.html↗

url http://example.com:32000/mail/index.html?/mail/index.html?default_layout=OUTLOOK2003&layout_settings[OUTLOOK2003]=test;[file]%00;2↗

• → Detect requests to /mail/include.html or /mail/index.html containing both 'default_layout' and 'layout_settings' parameters in the query string, especially when combined with a null byte (%00) — indicative of path traversal/file inclusion exploitation. ↗
• → Flag HTTP requests to the mail application where the User-Agent header is unrecognized/non-standard AND the query string includes 'default_layout' and 'layout_settings' parameters simultaneously. ↗
• → Monitor for null-byte injection (%00) in query parameters targeting /mail/index.html or /mail/include.html, as used in the exploit payload to truncate file paths. ↗
• → This vulnerability was confirmed actively exploited in the wild as of July 2007; prioritize detection on Merak Mail Server 8.3.0r and VisNetic MailServer 8.3.0 build 1 deployments. ↗

• · The exploit requires the attacker to supply an unrecognized User-Agent string; standard/known browser User-Agent strings will not trigger the uninitialized variable condition. ↗
• · Affected versions are specifically IceWarp Web Mail 5.5.1 as bundled with Merak Mail Server 8.3.0r and VisNetic Mail Server 8.3.0 build 1; other versions may differ in exploitability. ↗

CVSS provenance

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

vulncheck 5.0 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.