MailSite Express Security Issue Using the default installation of MailSite Express allows an executable file security risk. NOTE: This issue is resolved in MailSite 6 and later. The default installation allows executable permissions for the cache directory in MailSite express directory location. An unscrupulous user can upload a malicious file and compromise the server.

Disabling the execute/script permissions on the cache directory will now not allow any executables files to run preventing this security issue.

In order to secure MailSite Express, follow the steps below:

1. Open The IIS management console
2. Click on the plus (+) next to the computer icon
3. Expand DEFAULT WEB SITE (default installation)
4. Expand the EXPRESS virtual directory
5. Right click on the CACHE folder
6. Select PROPERTIES
7. Set EXECUTE PERMISSION to NONE

This should be done on all web sites if you are using multiple installations of MailSite Express.

NOTE:
This issue was reported by Marceta Milos, a security consultant, you can contact him at root@marcetam.net for more information or help with other security issues. Mr Milos is not associated with Rockliffe systems in any way. Rockliffe systems cannot be held responsible for any advice given by Mr Milos.