Software602 602Pro LAN SUITE 2003 Directory Traversal Vulnerability

Bugtraq ID:	8701
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 25 2003 12:00AM
Updated:	Sep 25 2003 12:00AM
Credit:	Discovery credited to Phuong Nguyen.
Vulnerable:	Software602 602Pro LAN SUITE 2003
Not Vulnerable:

Software602 602Pro LAN SUITE 2003 Directory Traversal Vulnerability

A problem with the handling of directory traversal requests has been identified in Software602 602Pro LAN SUITE 2003. Because of this, an attacker may be able to gain access to potentially sensitive information.

Software602 602Pro LAN SUITE 2003 Directory Traversal Vulnerability

No exploit is required for this vulnerability. The following proof-of-concept has been made available by Phuong Nguyen:

http://www.example.com/mail/m602cl3w.exe?A=GetFile&USER=7921604D7A587937986E24242C0588&DL=0&FN=../../../boot.ini

where USER signifies the current webmail user's username.

Software602 602Pro LAN SUITE 2003 Directory Traversal Vulnerability

Solution:
The vendor has released a new build 2003.0.03.0828 to address this issue:


Software602 602Pro LAN SUITE 2003

• Software602 602 LAN Suite 2003 (Build 2003.0.03.0828)
  http://www.software602.com/download/

Software602 602Pro LAN SUITE 2003 Directory Traversal Vulnerability

References:

• 602Pro LAN SUITE Product Page (Software602)
  
• LanSuite 2003 - Multiple Vulnerabilities (Phuong Nguyen )
  
• Re: LanSuite 2003 - Multiple Vulnerabilities (Stan Bubrouski )