|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||
SecurityAlert : 3723 CVE : CVE-2008-1221 SecurityRisk : Medium  (About) Remote Exploit : Yes Local Exploit : No Exploit Available : Yes Credit : Luigi Auriemma Published : 10.03.2008
Advisory Content : ####################################################################### Luigi Auriemma Application: MicroWorld eScan Server (aka eScan Management Console) http://www.mwti.net Versions: <= 9.0.742.98 Platforms: Windows Bug: directory traversal Exploitation: remote Date: 06 Mar 2008 Author: Luigi Auriemma e-mail: aluigi (at) autistici (dot) org [email concealed] web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== From vendor's website: "The Powerful Management Console of eScan provides options for system administrators to remotely administer a vast network of clients. It also allows them to remotely install eScan, deploy upgrades and updates and enforce an Integrated Security Policy for the entire Enterprise." ####################################################################### ====== 2) Bug ====== The eScan Server (eserv.exe) listens on port 2021 for FTP connections using c:pub as root path. Although the server tries to avoid possible directory traversal attacks for example rejecting the dotdot patterns, is still possible for an attacker to download any file from the disk of the remote system simply applying a slash or a backslash at the beginning of the filename for selecting the root path of the disk. For example /boot.ini, windowswin.ini and so on. Only downloading files is allowed by the server, so deleting or uploading custom files is not possible. ####################################################################### =========== 3) The Code =========== ftp://SERVER:2021//windows/win.ini or manually: ftp -A open SERVER 2021 get /windows/win.ini local_win.ini ####################################################################### ====== 4) Fix ====== No fix ####################################################################### --- Luigi Auriemma http://aluigi.org  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
libc:fts_*() Multiple Denial of Service
The fts functions are provided for traversing UNIX file hierarchies... |
||
| Apache |  |
|
» Apache Tomcat 6.0.20 and |
||
» Apache Tomcat 6.0.20 and |
||
» Apache Tomcat 6.0.20 and |
||
| PHP | |
|
» PHP 5.2.12/5.3.1 |
||
- 2009-10-02| Copyright © SecurityReason.com. All Rights Reserved. |