IBM Director Redirect.bat Directory Traversal Vulnerability

Bugtraq ID:	19898
Class:	Input Validation Error
CVE:	CVE-2006-0513
Remote:	Yes
Local:	No
Published:	Sep 07 2006 12:00AM
Updated:	Sep 08 2006 08:32PM
Credit:	Daniel Clemens is credited with the discovery of this vulnerability.
Vulnerable:	IBM Director 3.1 IBM Director 0
Not Vulnerable:	IBM Director 5.10

IBM Director Redirect.bat Directory Traversal Vulnerability

IBM Director is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks.

Versions prior to 5.10 are vulnerable to this issue.

IBM Director Redirect.bat Directory Traversal Vulnerability

The following proof-of-concept URI is available:

• /data/vulnerabilities/exploits/ibmdirector-sep72006.html

IBM Director Redirect.bat Directory Traversal Vulnerability

Solution:
IBM has addressed this issue in version 5.10.

Please see the references for more information.

IBM Director Redirect.bat Directory Traversal Vulnerability

References:

• IBM Director Homepage (IBM)
  
• IBM Director Release Notes 5.10 (IBM)