Info

Disclosure

Nov 03, 2004

Discovery

Unknown

Dates

Exploit

Nov 03, 2004

Solution

Unknown

Description

MailPost contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a specially crafted request using the *debug* query sting is set to a server with debug mode enabled (which is enabled by default), which will disclose server information (folder that contains web files, server version) resulting in a loss of confidentiality.

Classification

Location: Remote/Network Access Required
Attack Type: Information Disclosure
Impact: Loss of Confidentiality
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

TIPS Incorporated

MailPost

5.1.1sv

References

Security Tracker: 1012070
Related OSVDB ID: 11410 11412 11413
Secunia Advisory ID: 13093
ISS X-Force ID: 17952
CVE ID: 2004-1103 (see also: NVD)
CERT VU: 858726
Vendor URL: http://www.mcenter.com/mailpost/
Other Advisory URL: http://www.procheckup.com/security_info/vuln_pr0409.html
Keyword: ProCheckUp Security Bulletin PR04-09

Credit

Gemma Hughes - gemma.hughesprocheckup.com - ProCheckUp

Direct URL: http://osvdb.org/36218