Michael Lamont Savant HTTP Server Directory Traversal Vulnerability

Bugtraq ID:	2697
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 17 2001 12:00AM
Updated:	Feb 17 2001 12:00AM
Credit:	Posted to Bugtraq by Tom Tom <[email protected]> on May 6, 2001 and discovered by t-Omicr0n <[email protected]> on February 17, 2001.
Vulnerable:	Michael Lamont Savant WebServer 2.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows NT 4.0
Not Vulnerable:

Michael Lamont Savant HTTP Server Directory Traversal Vulnerability

It is possible for an attacker to traverse the web folders of a Savant HTTP Server. Submitting a URL referring to a known directory or file, and appended with specific unicode characters, will disclose the contents of the requested resource. The unicode character in question is '%2f..'. This vulnerability could allow the reading of files on the target system.

Michael Lamont Savant HTTP Server Directory Traversal Vulnerability

http://example.com/%2f..%2f..%2f../filename

Michael Lamont Savant HTTP Server Directory Traversal Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Michael Lamont Savant HTTP Server Directory Traversal Vulnerability

References:

• Savant Home Page (Michael Lamont)