TIPS MailPost Remote File Enumeration Vulnerability

Bugtraq ID:	11599
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 03 2004 12:00AM
Updated:	Nov 03 2004 12:00AM
Credit:	Disclosure of this issue is credited to Gemma Hughes <[email protected]>.
Vulnerable:	TIPS MailPost 5.1.1 sv
Not Vulnerable:

TIPS MailPost Remote File Enumeration Vulnerability

TIPS MailPost is affected by a remote file enumeration vulnerability. This issue is due to a failure to properly sanitize user requests.

An attacker may leverage this issue to gain knowledge of the existence of files outside the Web root directory. Information disclosed in this way may facilitate further attacks.

TIPS MailPost Remote File Enumeration Vulnerability

No exploit is required to leverage this issue. The following proof of concet has been provided:

http://www.example.com/scripts/mailpost.exe/..%255c..%255c..%255cwinnt/system.ini?*nosend*=&[email protected]

TIPS MailPost Remote File Enumeration Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

TIPS MailPost Remote File Enumeration Vulnerability

References:

• MailPost Home Page (TIPS)
  
• ProCheckUp SecurityBulletin PR04-09 - MailPost File Information Disclosure (ProCheckUp)
  
• Vulnerability Note VU#306086 - MailPost vulnerable file information disclosure (US-CERT)