Info

Disclosure

Nov 03, 2004

Discovery

Unknown

Dates

Exploit

Nov 03, 2004

Solution

Unknown

Description

MailPost contains a flaw that may lead to an unauthorized information disclosure. The issue is due to the 'mailpost.exe' script not properly sanitizing user-supplied input. By adding a trailing slash to a requested filename, the error page will disclose the installation path resulting in a loss of confidentiality.

Classification

Location: Remote/Network Access Required
Attack Type: Information Disclosure
Impact: Loss of Confidentiality
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

TIPS, inc.

MailPost

5.1.1sv

References

Security Tracker: 1012070
Related OSVDB ID: 11410 11411 11412
Bugtraq ID: 11598
Secunia Advisory ID: 13093
ISS X-Force ID: 17951
CVE ID: 2004-1101 (see also: NVD)
CERT VU: 596046
Vendor URL: http://www.mcenter.com/mailpost/
Other Advisory URL: http://www.procheckup.com/security_info/vuln_pr0411.html

Credit

Gemma Hughes - gemma.hughesprocheckup.com - ProCheckUp

Direct URL: http://osvdb.org/36218