In-Reply-To: <000501c3fdfc$7f0202d0$0b3016ac@fucku> >Directory Listing: >----------------------- >Upon refering to index.html directory listing of the folder is printed: >http://<host>/index.html - directory listing >http://<host>/cgi-bin/ >http://<host>/users/ This is a user configuration issue, NOT A BUG. If the user enables the option 'Directory browsing', then any folder that does not have an index files can be viewed. This is by design. >Local Path Disclosure: >------------------------------- >Inside the mail login form, the local path of the server's folder is >specified. >http://<host>/mail/ ><input type="hidden" name="Mail602Dir" value="C:\LANSUITE"> This has been confirmed and fixed in 602LAN SUITE 2004. You can obtain the latest version at: http://www.software602.com/download/ >Cross Site Scripting: >---------------------------- >When reffering to index.html as folder, text and script injection is >available. >http://<host>/index.html/<script>alert('XSS')</script> >From our testing this is a false vulnerability. We have been unable to replicate this issue. We have sent an e-mail to Rafel Ivgi for more information, but Rafel has not supplied us verifiable proof. Regards, Brandon Sturgeon Product Manager Software602, Inc. ----------------- http://www.software602.com
