BVRP Software SLWebmail ShowGodLog.DLL File Disclosure Vulnerability
BID:7513
Info
BVRP Software SLWebmail ShowGodLog.DLL File Disclosure Vulnerability
| Bugtraq ID: | 7513 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 07 2003 12:00AM |
| Updated: | May 07 2003 12:00AM |
| Credit: | Discovery of this vulnerability credited to David Litchfield ([email protected]) and Mark Litchfield ([email protected]). |
| Vulnerable: |
BVRP Software SLWebMail 3 |
| Not Vulnerable: | |
Discussion
BVRP Software SLWebmail ShowGodLog.DLL File Disclosure Vulnerability
SLWebmail has been reported prone to a file disclosure vulnerability. The issue presents itself due to a lack of sufficient sanitization performed on user supplied URI parameters to the ShowGodLog.DLL library.
Reportedly, by supplying an arbitrary filename, an attacker may exploit this vulnerability to disclose the contents of any anonymous Internet account readable file in the attacker's browser.
SLWebmail has been reported prone to a file disclosure vulnerability. The issue presents itself due to a lack of sufficient sanitization performed on user supplied URI parameters to the ShowGodLog.DLL library.
Reportedly, by supplying an arbitrary filename, an attacker may exploit this vulnerability to disclose the contents of any anonymous Internet account readable file in the attacker's browser.
Solution / Fix
BVRP Software SLWebmail ShowGodLog.DLL File Disclosure Vulnerability
Solution:
Affected users are advised to contact the vendor for upgrade information.
Solution:
Affected users are advised to contact the vendor for upgrade information.
References
BVRP Software SLWebmail ShowGodLog.DLL File Disclosure Vulnerability
References:
References:
- BVRP Software (BVRP Software)
- Multiple Vulnerabilities in SLWebmail ("NGSSoftware Insight Security Research"