Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
(Vendor Issues Fix) 602Pro LAN SUITE Discloses Directory Listings and Installation Path to Remote Users
|
|
SecurityTracker Alert ID: 1009388 |
|
SecurityTracker URL: http://securitytracker.com/id/1009388
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Mar 11 2004
|
Impact:
Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 1.04
|
Description:
Rafel Ivgi (The-Insider) reported a vulnerability in 602Pro LAN SUITE. A remote user can view directory listings on the system, determine the physical installation path, and conduct cross-site scripting attacks. [Editor's note: The vendor disputes some of these claims.]
It is reported that a remote user user can use the following URLs to obtain a directory listing [CVE: CAN-2004-0335]:
http://<host>/index.html - directory listing
http://<host>/cgi-bin/
http://<host>/users/
[Editor's note: The vendor reports that this is a configuration option. The user can use the 'Directory browsing' feature to enable or disable this behavior.]
It is reported that the login form ('http://<host>/mail/') contains a hidden variable 'Mail602Dir' that discloses the LAN SUITE installation path [CVE: CAN-2004-0336]. [Editor's note: The vendor has confirmed this flaw.]
It is also reported that 'index.html' does not filter HTML code from user-supplied input before displaying the user-supplied information [CVE: CAN-2004-0337]. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the 602Pro LAN SUITE software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user. A demonstration exploit URL is provided:
http://<host>/index.html/<script>alert('XSS')</script>
[Editor's note: The vendor has been unable to reproduce this claim.]
|
Impact:
A remote user can view certain directory listings.
A remote user can determine the installation path.
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the 602Pro LAN SUITE software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
[Editor's note: The vendor has confirmed the path disclosure vulnerability, has indicated that the directory listing feature is configurable by the user and, as such, is not a vulnerability, and has been unable to reproduce the cross-site scripting report.]
|
Solution:
The vendor has issued a fix for the path disclosure flaw in 602LAN SUITE 2004, available at:
http://www.software602.com/download/
[Editor's note: As indicated in the Source Message, the vendor disputes most of the claims, except for the patch disclosure flaw, which has reportedly been fixed.]
|
Vendor URL: www.software602.com/ (Links to External Site)
|
Cause:
Access control error, Input validation error
|
Underlying OS:
Windows (Any)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: 10 Mar 2004 19:05:50 -0000
Subject: Re: LAN SUITE Web Mail 602Pro Multiple Vulnerabilities
|
In-Reply-To: <000501c3fdfc$7f0202d0$0b3016ac@fucku>
>Directory Listing:
>-----------------------
>Upon refering to index.html directory listing of the folder is printed:
>http://<host>/index.html - directory listing
>http://<host>/cgi-bin/
>http://<host>/users/
This is a user configuration issue, NOT A BUG. If the user enables the option 'Directory browsing', then any folder that does not
have an index files can be viewed. This is by design.
>Local Path Disclosure:
>-------------------------------
>Inside the mail login form, the local path of the server's folder is
>specified.
>http://<host>/mail/
><input type="hidden" name="Mail602Dir" value="C:\LANSUITE">
This has been confirmed and fixed in 602LAN SUITE 2004.
You can obtain the latest version at:
http://www.software602.com/download/
>Cross Site Scripting:
>----------------------------
>When reffering to index.html as folder, text and script injection is
>available.
>http://<host>/index.html/<script>alert('XSS')</script>
>From our testing this is a false vulnerability. We have been unable to replicate this issue. We have sent an e-mail to Rafel Ivgi
for more information, but Rafel has not supplied us verifiable proof.
Regards,
Brandon Sturgeon
Product Manager
Software602, Inc.
-----------------
http://www.software602.com
|
|
Go to the Top of This SecurityTracker Archive Page
|
