Published:2006/05/09  Last Updated:2008/05/21

JVN#84775942
Multiple email clients vulnerable to directory traversal due to inappropriate unicode handling

Overview

Some email clients contain a vulnerability when handling an attached file with a file name using unicode. This may result in a directory traversal attack or displaying a file name diffrently from the actual file name.

Products Affected

  • For more information, refer to the vendors' websites

Description

Impact

Actual impact could differ depending on the email clients though, an attacker coulld possibly forge a file name or a email client could handle a file inappropriately which may result in a file being overwritten or an arbitray file being created and saved in an arbitrary directory.

Solution

Vendor Status

Vendor Status Last Update Vendor Notes
Allied Telesis K.K. Not Vulnerable 2006/05/09
Cybozu, Inc. Not Vulnerable 2006/05/09
FUJITSU LIMITED Not Vulnerable 2006/05/09
HDE, Inc. Not Vulnerable 2006/05/09
Hitachi Not Vulnerable 2006/05/09
JustSystems Corporation Not Vulnerable 2006/05/09
Matsushita Electric Industrial Co., Ltd. Not Vulnerable, investigating 2006/05/09
Microsoft Co.,Ltd. Not Vulnerable 2006/05/09
NIPPON CONTROL SYSTEM Corporation Vulnerable 2006/05/09
Orangesoft Inc. Not Vulnerable 2006/05/09
RimArts, Inc. Vulnerable 2006/05/09
Saitoh Kikaku Not Vulnerable 2006/05/09
Yamaha Corporation Not Vulnerable 2006/05/09
B.U.G., Inc. Not Vulnerable 2006/05/09
RICOH COMPANY, LTD. Vulnerable 2006/06/29
NEC Corporation Not Vulnerable, investigating 2006/05/09

References

JPCERT/CC Addendum

Credit

Yosuke Hasegawa reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendors under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE
JVN iPedia JVNDB-2006-000617

Update History