Re: LAN SUITE Web Mail 602Pro Multiple Vulnerabilities

[Brandon Sturgeon <brandon () software602 com>]

In-Reply-To: <000501c3fdfc$7f0202d0$0b3016ac@fucku>

> Directory Listing:
> -----------------------
> Upon refering to index.html directory listing of the folder is printed:
> http://<host>/index.html - directory listing
> http://<host>/cgi-bin/
> http://<host>/users/


This is a user configuration issue, NOT A BUG. If the user enables the option 'Directory browsing', then any folder 
that does not have an index files can be viewed. This is by design.


> Local Path Disclosure:
> -------------------------------
> Inside the mail login form, the local path of the server's folder is
> specified.
> http://<host>/mail/
> <input type="hidden" name="Mail602Dir" value="C:\LANSUITE">


This has been confirmed and fixed in 602LAN SUITE 2004.
You can obtain the latest version at:

http://www.software602.com/download/


> Cross Site Scripting:
> ----------------------------
> When reffering to index.html as folder, text and script injection is
> available.
> http://<host>/index.html/&lt;script&gt;alert('XSS')&lt;/script&gt;


> From our testing this is a false vulnerability. We have been unable to replicate this issue. We have sent an e-mail to 
> Rafel Ivgi for more information, but Rafel has not supplied us verifiable proof.


Regards,

Brandon Sturgeon
Product Manager
Software602, Inc.
-----------------
http://www.software602.com