|
602Pro LANSuite 2003 Multiple Vulnerabilities
|
|
Secunia Advisory:
|
SA9882
|
|
|
Release Date:
|
2003-09-30
|
|
Popularity:
|
6,572 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Security Bypass
Exposure of sensitive information
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | 602Pro LAN SUITE 2003
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
Description:
Two vulnerabilities have been reported in LANSuite 2003 allowing malicious people to see sensitive information.
1) Certain files with information about current users are available to malicious people from the "/mail/" folder. The file "tempdirs.lst" contains information about temporary folder names used by authenticated users. The temporary folder contains two files ("MSGlist.mid" and "MSGlist.mil"), which contains message IDs, username, and mailbox number.
Daily log files with information about username, user IP, and login times are also available from the "/mail/" folder. These files are named "S[YYMMDD].LOG".
2) Authenticated users may gain access to arbitrary files by exploiting a directory traversal vulnerability. The problem is that "M602cl3w.exe" doesn't verify the "FN" parameter properly when the function "GetFile" is used. This allows malicious users to traverse directories using "../".
The vulnerabilities have been reported in 602Pro LANSuite 2003 build 2003.0.3.0828. However, other versions may also be affected.
Solution:
Install update:
http://download3.software602.com/ls2003.exe
Provided and/or discovered by:
Phuong Nguyen
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
