IMAP security

[Antti Tolamo <antti@tola.org>]

Just noticed something odd, not sure is this
a security problem or what.

I have Debian potato server for own use , where I few days
ago installed IMAP 4.7c-1 because WAP email reading PHP/WML script
from:

http://e-sphere.net/

needs it.



Just few minutes ago I tried to fetch mail from one account
using Windows Eudora 5.1. I was checking multiple
times imap box to see has one test message come there.

And surprise suddenny  I can seewhole contents
directory of /var/www from Eudora.

I can inspect invidual files,  inspect directories
through Eudora folders,  I even see who owns the files( but I'm not
sure is it group or owner).   Can't delete files or change them
however.

Antti