Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: LAN SUITE Web Mail 602Pro Multiple Vulnerabilities

From: Brandon Sturgeon (brandonsoftware602.com)
Date: Wed Mar 10 2004 - 13:05:50 CST

In-Reply-To: <000501c3fdfc$7f0202d0$0b3016acfucku>

>Directory Listing:
>Upon refering to index.html directory listing of the folder is printed:
>http://<host>/index.html - directory listing

This is a user configuration issue, NOT A BUG. If the user enables the option 'Directory browsing', then any folder that does not have an index files can be viewed. This is by design.

>Local Path Disclosure:
>Inside the mail login form, the local path of the server's folder is
><input type="hidden" name="Mail602Dir" value="C:\LANSUITE">

This has been confirmed and fixed in 602LAN SUITE 2004.
You can obtain the latest version at:


>Cross Site Scripting:
>When reffering to index.html as folder, text and script injection is

From our testing this is a false vulnerability. We have been unable to replicate this issue. We have sent an e-mail to Rafel Ivgi for more information, but Rafel has not supplied us verifiable proof.


Brandon Sturgeon
Product Manager
Software602, Inc.