RRDBrowse File Parameter Directory Traversal Vulnerability

Bugtraq ID:	22817
Class:	Input Validation Error
CVE:	CVE-2007-1303
Remote:	Yes
Local:	No
Published:	Mar 05 2007 12:00AM
Updated:	May 12 2015 07:33PM
Credit:	Sebastian Wolfgarten is credited with the discovery of this vulnerability.
Vulnerable:	RRDBrowse RRDBrowse 1.6
Not Vulnerable:

RRDBrowse File Parameter Directory Traversal Vulnerability

RRDBrowse is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve the contents of arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

This issue affects version 1.6; prior versions may also be affected.

RRDBrowse File Parameter Directory Traversal Vulnerability

Attackers may exploit this vulnerability via a browser.

The following proof of concept is available:

http://www.example.com/cgi-bin/rb.cgi?mode=page&file=../../../../../../../../etc/passwd

RRDBrowse File Parameter Directory Traversal Vulnerability

Solution:
The vendor released an update to address this issue. The vendor committed this update to the CVS repository. Please see the references for more information.

RRDBrowse File Parameter Directory Traversal Vulnerability

References:

• RRDBrowse Homepage (RRDBrowse)
  
• Security advisory: Arbitrary file disclosure vulnerability in (Sebastian Wolfgarten)
  
• Arbitrary file disclosure vulnerability in rrdbrowse <= 1.6 ([email protected])