[NT] Directory Traversal in Accipiter Direct AdServer

• Previous message: SecuriTeam: "[NEWS] Cisco Personal Assistant User Password Bypass Vulnerability"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 11 Jan 2004 12:01:46 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  Directory Traversal in Accipiter Direct AdServer
------------------------------------------------------------------------

SUMMARY

 <http://www.accipiter.com/> Accipiter Direct AdServer is "responsible for
advertisement handling for badge and banner ads as well as advertisement
tracking. The Direct server acts as an http server listening for
specially formed requests. It is a proprietary system and cannot be
disabled".
A security vulnerability has been found in Accipiter Direct Server 6 that
allows retrieval of arbitrary files.

DETAILS

Arbitrary files can be viewed by using the exploit detailed below.
Attacker traverses the HTTP server and retrieves arbitrary files by
sending specially formed requests through a web browser.

Exploit:
By using the following URL, a remote attacker can access the boot.ini file
under the Windows operating system:
http://accipiterserver/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini

Workaround:
Vendor will be providing a patch with the next major release. Until then
you may run your Accipiter Direct AdServer as an unprivileged user
restricted to the webroot.

ADDITIONAL INFORMATION

The information has been provided by <mailto:mbassett@omaha.com> Bassett,
Mark.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[NEWS] Cisco Personal Assistant User Password Bypass Vulnerability"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

• [UNIX] Tikiwiki Command Injection and Arbitrary File Exposure Vulnerabilities
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Two security vulnerabilities have
  been recently discovered in Tikiwiki, ... Remote exploitation of an input validation
  vulnerability in Tikiwiki ... allows attackers to gain access to arbitrary files on
  the vulnerable ... (Securiteam)
• [UNIX] Horde Project Cleanup Script Arbitrary File Deletion Vulnerability
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Horde Project Cleanup Script
  Arbitrary File Deletion Vulnerability ... Exploitation allows attackers to delete arbitrary
  files with the ... (Securiteam)
• [UNIX] Arbitrary File Corruption Vulnerability in Sun Solaris kcms_configure
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Solaris operating system can allow
  for the corruption of arbitrary files ... sanity checking a local attacker can redirect
  log file output to an ... * 04/27/2004 - Initial vendor response. ... (Securiteam)
• [NEWS] ASG-Sentry Multiple Vulnerabilities
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... ASG-Sentry Multiple Vulnerabilities
  ... product to delete arbitrary files, cause the product to crash and overflow ...
  Buffer overflow in FxIAList ... (Securiteam)