[NT] SafeNet Sentinel Protection and Key Server Directory Traversal

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



SafeNet Sentinel Protection and Key Server Directory Traversal
------------------------------------------------------------------------


SUMMARY

The <http://www.safenet-inc.com> Sentinel Protection and Key Server are
"two simple webservers for the monitoring of the licenses and listen
respectively on ports 6002 and 7002". A directory traversal vulnerability
has been discovered in both SafeNet Sentinel protection server as well as
their key server.

DETAILS

Vulnerable Systems:
* SafeNet Sentinel Protection Server version 7.4.1.0
* SafeNet Sentinel Keys Server version 7.4.1.0

Both the webservers are affected by a directory traversal vulnerability
exploitable using the backslash delimiter (the servers don't support hex
chars) allowing an attacker to download any file in the disk on which the
services are installed.

It's funny to note that the security patch available from November 2007
was released just to fix a directory traversal vulnerability but they
dropped only the slash delimiter leaving the backslash working.

Exploit:
The following packet will trigger the vulnerability:
GET /..\..\..\..\..\..\..\boot.ini HTTP/1.0


ADDITIONAL INFORMATION

The information has been provided by <mailto:aluigi@xxxxxxxxxxxxx> Luigi
Auriemma.
The original article can be found at:
<http://aluigi.altervista.org/adv/sentinella-adv.txt>
http://aluigi.altervista.org/adv/sentinella-adv.txt



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.