BID:15393

Dev-Editor Virtual Directory Security Bypass Vulnerability

Info

Dev-Editor Virtual Directory Security Bypass Vulnerability

Bugtraq ID:	15393
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 11 2005 12:00AM
Updated:	Nov 11 2005 12:00AM
Credit:	Charles Morris is credited with the discovery of this vulnerability.
Vulnerable:	Dev-Editor Dev-Editor 3.0 Dev-Editor Dev-Editor 2.3.2 Dev-Editor Dev-Editor 2.3.1 Dev-Editor Dev-Editor 2.3 Dev-Editor Dev-Editor 2.2 a Dev-Editor Dev-Editor 2.1 a Dev-Editor Dev-Editor 2.1 Dev-Editor Dev-Editor 2.0

Not Vulnerable:	Dev-Editor Dev-Editor 3.0.1

Discussion

Dev-Editor Virtual Directory Security Bypass Vulnerability

Dev-Editor is prone to a vulnerability regarding the unauthorized access to directories outside the root virtual directory.

The problem presents itself in the way Dev-Editor handles access to virtual directories.

Successful exploitation will grant an attacker access to directories outside the designated root virtual directory. This will result in information disclosure, and access to possibly privileged information.

Exploit / POC

Dev-Editor Virtual Directory Security Bypass Vulnerability

No exploit is required.

Solution / Fix

Dev-Editor Virtual Directory Security Bypass Vulnerability

Solution:
The vendor has addressed this issue in version 3.0.1:

Dev-Editor Dev-Editor 2.0