Viking Server Relative Path Webroot Escaping Vulnerability

Bugtraq ID:	2643
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 23 2001 12:00AM
Updated:	Apr 23 2001 12:00AM
Credit:	This vulnerability was announced to Bugtraq by joetesta <[email protected]> on April 23, 2001.
Vulnerable:	RobTex Viking Server 1.0.7 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 3.5.1 - Microsoft Windows NT 4.0
Not Vulnerable:	RobTex Viking Server 1.0.7 -378

Viking Server Relative Path Webroot Escaping Vulnerability

The Viking Server is a freely available software package maintained and distributed by Robtex. The Viking Server provides multiple protocol service on Windows 95, 98, and NT systems.

A problem in the software package could make it possible for remote users to gain access to sensitive system files. Due to the improper handling of relative paths by the HTTP serving portion of the Viking Server, a user requesting a relative path such as "\...\" can gain access to the root directory, breaking out of the webroot.

This problem makes it possible for remote user to gain access to sensitive system files, and potentially local access.

Viking Server Relative Path Webroot Escaping Vulnerability

http://vulnerable.system/\...\

Viking Server Relative Path Webroot Escaping Vulnerability

Solution:
An upgrade is available:


RobTex Viking Server 1.0.7

• RobTex Viking Server 1.0.7-378
  ftp://ftp.robtex.com/robtex/viking/vslatest.zip

Viking Server Relative Path Webroot Escaping Vulnerability

References: