[NT] Directory Traversal in Accipiter Direct AdServer

From: SecuriTeam (support_at_securiteam.com)
Date: 01/11/04

  • Next message: SecuriTeam: "[UNIX] Leafnoe DoS (Missing Input)" 
    To: list@securiteam.com
Date: 11 Jan 2004 12:01:46 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Directory Traversal in Accipiter Direct AdServer
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.accipiter.com/> Accipiter Direct AdServer is "responsible for
    advertisement handling for badge and banner ads as well as advertisement
    tracking. The Direct server acts as an http server listening for
    specially formed requests. It is a proprietary system and cannot be
    disabled".
    A security vulnerability has been found in Accipiter Direct Server 6 that
    allows retrieval of arbitrary files.

    DETAILS

    Arbitrary files can be viewed by using the exploit detailed below.
    Attacker traverses the HTTP server and retrieves arbitrary files by
    sending specially formed requests through a web browser.

    Exploit:
    By using the following URL, a remote attacker can access the boot.ini file
    under the Windows operating system:
    http://accipiterserver/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini

    Workaround:
    Vendor will be providing a patch with the next major release. Until then
    you may run your Accipiter Direct AdServer as an unprivileged user
    restricted to the webroot.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:mbassett@omaha.com> Bassett,
    Mark.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] Leafnoe DoS (Missing Input)"

    Relevant Pages

    • [UNIX] Tikiwiki Command Injection and Arbitrary File Exposure Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Two security vulnerabilities have been recently discovered in Tikiwiki, ... Remote exploitation of an input validation vulnerability in Tikiwiki ... allows attackers to gain access to arbitrary files on the vulnerable ...
      (Securiteam)
    • [UNIX] Horde Project Cleanup Script Arbitrary File Deletion Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Horde Project Cleanup Script Arbitrary File Deletion Vulnerability ... Exploitation allows attackers to delete arbitrary files with the ...
      (Securiteam)
    • [UNIX] Arbitrary File Corruption Vulnerability in Sun Solaris kcms_configure
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Solaris operating system can allow for the corruption of arbitrary files ... sanity checking a local attacker can redirect log file output to an ... * 04/27/2004 - Initial vendor response. ...
      (Securiteam)
    • [NEWS] ASG-Sentry Multiple Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... ASG-Sentry Multiple Vulnerabilities ... product to delete arbitrary files, cause the product to crash and overflow ... Buffer overflow in FxIAList ...
      (Securiteam)