IBM Tivoli Directory Server LDACGI Directory Traversal Vulnerability

Bugtraq ID:	10841
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 02 2004 12:00AM
Updated:	Aug 02 2004 12:00AM
Credit:	It is unknown who originally disclosed this vulnerability.
Vulnerable:	IBM Directory Server 4.1 IBM Directory Server 3.2.2
Not Vulnerable:

IBM Tivoli Directory Server LDACGI Directory Traversal Vulnerability

IBM Tivoli Directory Server is reported to contain a directory traversal vulnerability in its web front-end application.

This issue presents itself due to insufficient sanitization of user-supplied data.

This issue allows remote attackers to view potentially sensitive files on the server that are accessible to the 'ldap' user. This may aid an attacker in conducting further attacks against the vulnerable computer.

Versions 3.2.2, and 4.1 are reported vulnerable.

IBM Tivoli Directory Server LDACGI Directory Traversal Vulnerability

No exploit is required. An example URI sufficient to exploit this vulnerability was provided:

http://www.example.com/ldap/cgi-bin/ldacgi.exe?Action=Substitute&Template=../../../../../boot.ini&Sub=LocalePath&LocalePath=enus1252

IBM Tivoli Directory Server LDACGI Directory Traversal Vulnerability

Solution:
The vendor has released fixes for this issue.


IBM Directory Server 3.2.2

• IBM SecureWay(R) Directory 3.2.2 Fix Pack 4
  http://www-1.ibm.com/support/docview.wss?uid=swg24006917

IBM Directory Server 4.1

• IBM Patch P410x-02M/P411W-02M
  http://www-1.ibm.com/support/docview.wss?uid=swg24006209

IBM Tivoli Directory Server LDACGI Directory Traversal Vulnerability

References:

• IBM Directory Server Directory Traversal Vulnerability ()
  
• IR52692: Problem with ldacgi (IBM)
  
• IR53631: SYSROUTE OF IR52692: Problem with ldacgi (IBM)
  
• Tivoli Directory Server Homepage (IBM)
  
• Tivoli Software (IBM)