Directory Traversal in Accipiter Direct Server 6.0

From: Bassett, Mark (mbassett_at_omaha.com)
Date: 01/09/04

  • Next message: bugzilla_at_redhat.com: "[RHSA-2004:003-01] Updated CVS packages fix minor security issue" 
    Date: Fri, 9 Jan 2004 11:19:18 -0600
To: <bugtraq@securityfocus.com>, <full-disclosure@netsys.com>

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    -

    ~ Severity: High
    ~ Title: Accipiter Direct Server
    ~ Date: January 09, 2004

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    -

    Synopsis
    ========

    A security vulnerability has been found in Accipiter Direct Server 6
    that allows retrieval of arbitrary files.

    Background
    ==========

    Accipiter Direct Server is responsible for advertisement handling for
    badge and banner ads as well as advertisement tracking. The Direct
    server acts as an http server listening for specially formed requests.
    It is a proprietary system and cannot be disabled.

    Description
    ===========

    Arbitrary files can be viewed by using the exploit detailed in
    CVE-2000-1075

    Attacker traverses the http server and retrieves arbitrary files by
    sending specially formed requests through a web browser.

    http://accipiterserver/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini

    Workaround
    ==========

    Vendor will be providing a patch with the next major release. Until
    then you may run your accipiter direct server as an unprivileged user
    restricted to the webroot.

    Mark Bassett
    Network Administrator
    World media company
    Omaha.com
    402-898-2079

  • Next message: bugzilla_at_redhat.com: "[RHSA-2004:003-01] Updated CVS packages fix minor security issue"