bugtraq - Re: LAN SUITE Web Mail 602Pro Multiple Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 10 Mar 2004 19:05:50 -0000
From: Brandon Sturgeon <brandon@...tware602.com>
To: bugtraq@...urityfocus.com
Subject: Re: LAN SUITE Web Mail 602Pro Multiple Vulnerabilities

In-Reply-To: <000501c3fdfc$7f0202d0$0b3016ac@...ku>

>Directory Listing:
>-----------------------
>Upon refering to index.html directory listing of the folder is printed:
>http://<host>/index.html - directory listing
>http://<host>/cgi-bin/
>http://<host>/users/

This is a user configuration issue, NOT A BUG. If the user enables the option 'Directory browsing', then any folder that does not have an index files can be viewed. This is by design.

>Local Path Disclosure:
>-------------------------------
>Inside the mail login form, the local path of the server's folder is
>specified.
>http://<host>/mail/
><input type="hidden" name="Mail602Dir" value="C:\LANSUITE">

This has been confirmed and fixed in 602LAN SUITE 2004.
You can obtain the latest version at:

http://www.software602.com/download/

>Cross Site Scripting:
>----------------------------
>When reffering to index.html as folder, text and script injection is
>available.
>http://<host>/index.html/&lt;script&gt;alert('XSS')&lt;/script&gt;

From our testing this is a false vulnerability. We have been unable to replicate this issue. We have sent an e-mail to Rafel Ivgi for more information, but Rafel has not supplied us verifiable proof.

Regards,

Brandon Sturgeon
Product Manager
Software602, Inc.
-----------------
http://www.software602.com