TA-2003-06 php-form-misconfiguration in VisNetic WebMail v.5.8.6.6 contributed by: rushjo ========================================================================= Tripbit Security Advisory
TA-2003-06 php-form-misconfiguration in VisNetic WebMail v.5.8.6.6 =========================================================================
PROGRAM: VisNetic WebMail v.5.8.6.6 HOMEPAGE: http://www.deerfield.com VULNERABLE VERSIONS: v.5.8.6.6 RISK: Medium IMPACT: Unauthorized file viewing RELEASE DATE: 2003-06
========================================================================= TABLE OF CONTENTS =========================================================================
1.............................................................DESCRIPTION 2.................................................................DETAILS 3...............................................................SOLUTIONS 4...........................................................VENDOR STATUS 5.................................................................CREDITS 6..............................................................DISCLAIMER 7..............................................................REFERENCES 8................................................................FEEDBACK
1. DESCRIPTION =========================================================================
VisNetic MailServer: a multi-threaded, multiprocessor capable mail server that supports the most widely used mail protocols including SMTP, POP3, IMAP4, (including ACL) and LDAP. Each of these protocols can be secured using SSL/TLS and it can accommodate unlimited domains and accounts with built-in support for the VisNetic AntiVirus Plug-in.
VisNetic WebMail: a web-based mail system providing access to e-mail using any web browser from
2. DETAILS =========================================================================
There exists a bug in the VisNetic WebMail, which can be exploit to see the php source code of any file, by adding a "dot" behing the to viewing site.
Example:
http://host:32000/mail/admin/../include.html. http://host:32000/mail/admin/../settings.html.
3. SOLUTIONS =========================================================================
No solution for the moment.
4. VENDOR STATUS =========================================================================
The vendor has reportedly been notified and is working on an solution.
5. CREDITS =========================================================================
Discovered by posidron
6. DISLAIMER =========================================================================
The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk.
7. REFERENCES =========================================================================
http://www.tripbit.org
8. FEEDBACK =========================================================================
Please send suggestions, updates, and comments to:
Tripbit Security Advisory
Site: http://www.tripbit.org Mail: rushjo@tripbit.org posidron@tripbit.org tec@tripbit.org
