BID:10646

Qbik WinGate Information Disclosure Vulnerability

Info

Qbik WinGate Information Disclosure Vulnerability

Bugtraq ID:	10646
Class:	Input Validation Error
CVE:	CVE-2004-0577 CVE-2004-0578
Remote:	Yes
Local:	No
Published:	Jul 01 2004 12:00AM
Updated:	Jul 12 2009 05:16AM
Credit:	An anonymous contributor is credited with discovery.
Vulnerable:	Qbik WinGate Pro 6.0 Beta 2 Build 942 Qbik WinGate Pro 5.2.3 Build 901 Qbik WinGate Pro 5.0.5 Qbik WinGate Plus 6.0 Beta 2 Build 942 Qbik WinGate Plus 5.2.3 Build 901 Qbik WinGate Plus 5.0.5

Not Vulnerable:

Discussion

Qbik WinGate Information Disclosure Vulnerability

WinGate is reported susceptible to an information disclosure vulnerability in its HTTP proxy server.

An internal web server contained in WinGate improperly allows attackers access to read arbitrary files outside of its document root. WinGate by default runs as the localsystem user, therefore this vulnerability allows remote attackers to read system files.

An attacker can exploit this issue to read arbitrary files contained on the WinGate computer. These files may contain sensitive information that may aid in further attacks.