F-Secure Web Console Directory Traversal Vulnerability

Bugtraq ID:	15284
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Nov 02 2005 12:00AM
Updated:	Nov 02 2005 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	F-Secure Internet Gatekeeper 6.42 F-Secure Internet Gatekeeper 6.41 F-Secure Internet Gatekeeper 6.40 0 F-Secure Anti-Virus for MS Exchange 6.40
Not Vulnerable:

F-Secure Web Console Directory Traversal Vulnerability

F-Secure Anti-Virus for Microsoft Exchange and F-Secure Internet Gatekeeper are prone to a directory traversal vulnerability.

Reports indicate that the Web Console for the products can allow remote unauthorized attackers to view arbitrary files in the context of the application.

It should be noted that the Web Console for F-Secure Anti-Virus for Microsoft Exchange and F-Secure Internet Gatekeeper is configured by default to accept connections from localhost only. The remote threat only arises if the application has been configured to accept connections from elsewhere. The default configuration only poses a local threat.

F-Secure Web Console Directory Traversal Vulnerability

An exploit is not required.

F-Secure Web Console Directory Traversal Vulnerability

Solution:
F-Secure has released fixes to address this issue.


F-Secure Internet Gatekeeper 6.40 0

• F-Secure fsigk.shtml
  http://www.f-secure.com/anti-virus/webclub/fsigk.shtml

F-Secure Anti-Virus for MS Exchange 6.40

• F-Secure fsavmse640-01.zip
  ftp://ftp.f-secure.com/support/hotfix/fsav-mse/fsavmse640-01.zip

F-Secure Internet Gatekeeper 6.41

• F-Secure fsigk.shtml
  http://www.f-secure.com/anti-virus/webclub/fsigk.shtml

F-Secure Internet Gatekeeper 6.42

• F-Secure fsigk642-01.zip
  ftp://ftp.f-secure.com/support/hotfix/fsig/fsigk642-01.zip

F-Secure Web Console Directory Traversal Vulnerability

References:

• F-Secure Security Bulletin FSC-2005-2 (F-Secure)