CVE-2011-0063

Name of the Vulnerable Software and Affected Versions Majordomo versions 20110203 and earlier

Description The issue allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ./../ sequence in the extra parameter to the help command. This is due to an incomplete fix for a previous issue, which causes the regular expression to produce .. (dot dot) sequences.

Recommendations For Majordomo versions 20110203 and earlier, consider restricting access to the help command or disabling the list file get function in lib/Majordomo.pm until a complete fix is available. Avoid using the extra parameter in the help command to minimize the risk of exploitation.