VisNetic MailServer Web Mail Interface Discloses PHP Source Code to Remote Users
|
|
SecurityTracker Alert ID: 1007046
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jun 24 2003
|
Impact: Disclosure of system information
|
Exploit Included: Yes
|
Advisory: Tripbit Security Research Group
|
Version(s): 5.8.6.6
|
Description: An information disclosure vulnerability was reported in VisNetic MailServer in the web mail interface. A remote user can view PHP source code.
Tripbit Security reported that a remote user can append a period character ('.') to a URL to view the PHP source code of the specified
web page.
Some demonstration exploit URLs are provided:
http://host:32000/mail/admin/../include.html.
http://host:32000/mail/admin/../settings.html.
The
vendor has reportedly been notified.
|
Impact: A remote user can view the source code of PHP scripts on the web mail interface.
|
Solution: No solution was available at the time of this entry. The vendor is reportedly working on a fix.
|
Vendor URL: www.deerfield.com/download/visnetic_mailserver/ (Links to External Site)
|
Cause: Access control error, Input validation error
|
Underlying OS: Windows (Any)
|
Reported By: "Rushjo@tripbit.org" <rushjo@tripbit.org>
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 23 Jun 2003 20:44:41 +0200
From: "Rushjo@tripbit.org" <rushjo@tripbit.org>
Subject: TA-2003-06 php-form-misconfiguration in VisNetic WebMail v.5.8.6.6
|
TA-2003-06 php-form-misconfiguration in VisNetic WebMail v.5.8.6.6
contributed by: rushjo
=========================================================================
Tripbit Security Advisory
TA-2003-06 php-form-misconfiguration in VisNetic WebMail v.5.8.6.6
=========================================================================
PROGRAM: VisNetic WebMail v.5.8.6.6
HOMEPAGE: http://www.deerfield.com
VULNERABLE VERSIONS: v.5.8.6.6
RISK: Medium
IMPACT: Unauthorized file viewing
RELEASE DATE: 2003-06
=========================================================================
TABLE OF CONTENTS
=========================================================================
1.............................................................DESCRIPTION
2.................................................................DETAILS
3...............................................................SOLUTIONS
4...........................................................VENDOR STATUS
5.................................................................CREDITS
6..............................................................DISCLAIMER
7..............................................................REFERENCES
8................................................................FEEDBACK
1. DESCRIPTION
=========================================================================
VisNetic MailServer: a multi-threaded, multiprocessor capable mail
server that supports the most widely used mail protocols including SMTP,
POP3, IMAP4, (including ACL) and LDAP. Each of these protocols can be
secured using SSL/TLS and it can accommodate unlimited domains and
accounts with built-in support for the VisNetic AntiVirus Plug-in.
VisNetic WebMail: a web-based mail system providing access to e-mail
using any web browser from
2. DETAILS
=========================================================================
There exists a bug in the VisNetic WebMail, which can be exploit to see
the php source code of any file, by adding a "dot" behing the to viewing
site.
Example:
http://host:32000/mail/admin/../include.html.
http://host:32000/mail/admin/../settings.html.
3. SOLUTIONS
=========================================================================
No solution for the moment.
4. VENDOR STATUS
=========================================================================
The vendor has reportedly been notified and is working on an solution.
5. CREDITS
=========================================================================
Discovered by posidron
6. DISLAIMER
=========================================================================
The information within this paper may change without notice. Use of
this information constitutes acceptance for use in an AS IS condition.
There are NO warranties with regard to this information. In no event
shall the author be liable for any damages whatsoever arising out of
or in connection with the use or spread of this information. Any use
of this information is at the user's own risk.
7. REFERENCES
=========================================================================
http://www.tripbit.org
8. FEEDBACK
=========================================================================
Please send suggestions, updates, and comments to:
Tripbit Security Advisory
Site: http://www.tripbit.org
Mail: rushjo@tripbit.org
posidron@tripbit.org
tec@tripbit.org
|
|
