MyServer Directory Traversal Vulnerability

Bugtraq ID:	11189
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 15 2004 12:00AM
Updated:	Sep 15 2004 12:00AM
Credit:	Discovery is credited to Arnaud Jacques aka scrap.
Vulnerable:	myServer myServer 0.7
Not Vulnerable:	myServer myServer 0.7.1

MyServer Directory Traversal Vulnerability

MyServer is reported prone to a remote directory traversal vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data. This vulnerability results in improper access to potentially sensitive files located outside of the document root of the web server.

MyServer version 0.7 is reportedly affected by this issue, however, other versions may be vulnerable as well.

MyServer Directory Traversal Vulnerability

No exploit is required.

The following proof of concept is available:
"GET ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../"

MyServer Directory Traversal Vulnerability

Solution:
The vendor has released MyServer 0.7.1 to address this issue.


myServer myServer 0.7

• MyServer MyServer 0.7.1
  http://sourceforge.net/projects/myserverweb/

MyServer Directory Traversal Vulnerability

References:

• myServer Home Page (myServer)