602ProLanSuite - Multiple Vulnerabilities
"602Pro LAN SUITE is an easy-to-install and manage all-in-one server application. Its standards-based SMTP/POP3 e-mail server provides effective e-mail communication without the risk of destructive virus infiltration and productivity robbing unsolicited e-mail. Fax services seamlessly integrate into user mailboxes to unify e-mail and fax message access."
More information at http://www.software602.com
Multiple vulnerabilities are found in the LanSuite 2003 software, particularly the WebMail interface, allowing an attacker to view sensitive information about the users and read arbitrary file on the server.
Sensitive Files Exposure,
Arbitrary File Reading.
[Vulnerability #1] Sensitive Files Exposure
The WebMail application inside LanSuite server, WGKC.lbs.exe will create temporary files and folder for holding related information about the current user and they are accessible through the LanSuite WebMail interface http://www.victim.com/mail/. The Temp{ip_list} file holds the temporary folder name of current users. The Malicious user can read any file on the server if they have a valid LanSuite WebMail username and password to access and to guess the names of temporary files, domain names, usernames and mailbox numbers respectively.
[Vulnerability #2] Arbitrary File Reading (required valid user credentials)
Malicious user can read any file on the server if they have a valid LanSuite WebMail username and password. The executable WGKC.lbs.exe does not check for the dot-dot-slash '../' when the action "GetFile" is used. For example, a malicious user can read the boot.ini file stored on the server by sending a request like this:
where "U" is the current user handles string. The malicious user can also read other user's mails by using the vulnerability #1.
[Vulnerability #1] Sensitive Files Exposure
Log files are also accessible by anyone through the following location http://www.victim.com/mail/LOGYYMMDDhhii. The attacker may get a hold of sensitive information, such as usernames, users' IP addresses, login time, and so forth. This information could be useful to assist in further attacks.
[Vulnerability #2] Arbitrary File Reading (required valid user credentials)
Vendor has verified and released a patch that addresses the issues. You can download the patch/fixed version at: http://download3.software602.com/ls/2003.eea
N/A
Phuong Nguyen (ECQ)
N/A
N/A