SAP Internet Graphics Server Directory Traversal Vulnerability

Bugtraq ID:	14369
Class:	Input Validation Error
CVE:	CVE-2005-1691
Remote:	Yes
Local:	No
Published:	Jul 25 2005 12:00AM
Updated:	Jul 12 2009 04:06PM
Credit:	Martin O'Neal <[email protected]> is credited with the discovery of this vulnerability.
Vulnerable:	SAP Internet Graphics Server 6.40
Not Vulnerable:	SAP Internet Graphics Server 6.40 Patch 11

SAP Internet Graphics Server Directory Traversal Vulnerability

Internet Graphics Server is affected by a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

A remote unauthorized user can disclose the contents of arbitrary local files through the use of directory traversal strings '../'. Exploitation of this vulnerability could lead to a loss of confidentiality.

SAP Internet Graphics Server Directory Traversal Vulnerability

No exploit is required.

The following proof of concept URI is available:
http://host/htdocs/../../../../../../../../../../../../etc/passwd

SAP Internet Graphics Server Directory Traversal Vulnerability

Solution:
The vendor has addressed this issue in Internet Graphics Server version 6.40 Patch 11. Please contact the vendor for information on obtaining the appropriate upgrade.

SAP Internet Graphics Server Directory Traversal Vulnerability

References:

• SAP Homepage (SAP)
  
• Corsaire Security Advisory: SAP Internet Graphics Server traversal issue (Corsaire)