CVE ID:	CVE-2009-4896
Description:	Multiple directory traversal vulnerabilities in the mlmmj-php-admin web interface for Mailing List Managing Made Joyful (mlmmj) 1.2.15 through 1.2.17 allow remote authenticated users to overwrite, create, or delete arbitrary files, or determine the existence of arbitrary directories, via a .. (dot dot) in a list name in a (1) edit or (2) save action.
Test IDs:	1.3.6.1.4.1.25623.1.0.67830
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2009-4896 40658 http://secunia.com/advisories/40658 DSA-2073 http://www.debian.org/security/2010/dsa-2073 [oss-security] 20100623 CVE Request -- mlmmj -- Directory traversal flaw by editing and saving list entries via php-admin web interface http://www.openwall.com/lists/oss-security/2010/06/23/5 [oss-security] 20100623 Re: CVE Request -- mlmmj -- Directory traversal flaw by editing and saving list entries via php-admin web interface http://www.openwall.com/lists/oss-security/2010/06/23/6 [oss-security] 20100625 Re: CVE Request -- mlmmj -- Directory traversal flaw by editing and saving list entries via php-admin web interface http://www.openwall.com/lists/oss-security/2010/06/25/2 [oss-security] 20100626 Re: CVE Request -- mlmmj -- Directory traversal flaw by editing and saving list entries via php-admin web interface http://www.openwall.com/lists/oss-security/2010/06/26/1 [oss-security] 20100704 Re: CVE Request -- mlmmj -- Directory traversal flaw by editing and saving list entries via php-admin web interface http://www.openwall.com/lists/oss-security/2010/07/04/4 [oss-security] 20100706 Re: CVE Request -- mlmmj -- Directory traversal flaw by editing and saving list entries via php-admin web interface http://www.openwall.com/lists/oss-security/2010/07/06/1 http://bugs.gentoo.org/show_bug.cgi?id=259968 http://bugs.gentoo.org/show_bug.cgi?id=259968 http://mlmmj.org/node/84 http://mlmmj.org/node/84 https://bugzilla.redhat.com/show_bug.cgi?id=607256 https://bugzilla.redhat.com/show_bug.cgi?id=607256