dirLIST Information Disclosure And Security Bypass Vulnerabilities

Bugtraq ID:	24987
Class:	Input Validation Error
CVE:	CVE-2007-3968 CVE-2007-3967
Remote:	Yes
Local:	No
Published:	Jul 20 2007 12:00AM
Updated:	Jul 05 2016 10:00PM
Credit:	The vendor disclosed these issues.
Vulnerable:	dirLIST dirLIST 0.1
Not Vulnerable:	dirLIST dirLIST 0.1.1

dirLIST Information Disclosure And Security Bypass Vulnerabilities

dirLIST is prone to multiple vulnerabilities that let attackers bypass security and obtain sensitive information; fixes are available. These issues occur because the application fails to properly sanitize user-supplied input.

An attacker may exploit these issues to obtain sensitive information and bypass the application's security mechanism. This may aid in further attacks.

dirLIST 0.1 is vulnerable to these issues.

dirLIST Information Disclosure And Security Bypass Vulnerabilities

An attacker may use a browser to exploit these issues.

dirLIST Information Disclosure And Security Bypass Vulnerabilities

Solution:
The vendor has released dirLIST 0.1.1 to address these issues; please see the references for details.


dirLIST dirLIST 0.1

• dirLIST dirLIST-v.0.1.1.zip
  http://downloads.sourceforge.net/dir-list/dirLIST-v.0.1.1.zip

dirLIST Information Disclosure And Security Bypass Vulnerabilities

References:

• dirLIST Web Site (dirLIST)
  
• dirLIST Changelog (dirLIST)