Check Point Advisories

MDaemon Content Filter Directory Traversal

Vulnerability
Protection

Check Point Reference:	CPAI-2005-275
Date Published:	19 Oct 2009
Severity:	Medium
Last Updated:	Monday 19 October, 2009
Source:
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	MDaemon is a Windows-based email server that provides full mail server functionality. MDaemon supports the SMTP, IMAP and POP3 protocols. MDaemon provides Content Filter functionality to filter incoming email messages based on the headers and message content. RFC 2183 defines header fields in a email message. There exists a directory traversal vulnerability in Alt-N MDaemon Content Filter and Anti Virus components. The vulnerability is caused due to improper sanitization of path names in email attachments. A remote attacker can send a specially crafted email, containing directory traversal sequences in the filename in order to create arbitrary files on the target file system. A successful attack will result in malicious files being placed in arbitrary locations on the target file system. The content of such files, may aid the attacker in additional attacks. If the malicious executable files are copied to the Startup directory of the target system, the programs will run automatically upon a restart of the host machine.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the MDaemon Content Filter Directory Traversal protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: SMTP Protection Violation.
Attack Information: MDaemon Content Filter directory traversal