Kantan WEB Server Unspecified Directory Traversal Vulnerability

Bugtraq ID:	31245
Class:	Input Validation Error
CVE:	CVE-2008-4797
Remote:	Yes
Local:	No
Published:	Sep 18 2008 12:00AM
Updated:	May 07 2015 05:24PM
Credit:	Daiki Fukumori of Secure Sky Technology, Inc.
Vulnerable:	Arihiro Kurata Kantan WEB Server 1.8
Not Vulnerable:	Arihiro Kurata Kantan WEB Server 1.9

Kantan WEB Server Unspecified Directory Traversal Vulnerability

Kantan WEB Server is prone to an unspecified directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary local files within the context of the webserver. Information harvested may aid in launching further attacks.

Versions prior to Kantan WEB Server 1.9 are vulnerable.

Kantan WEB Server Unspecified Directory Traversal Vulnerability

An attacker can exploit this issue via a browser.

Kantan WEB Server Unspecified Directory Traversal Vulnerability

Solution:
The vendor has released an updated version; please see the references for more information.


Arihiro Kurata Kantan WEB Server 1.8

• Arihiro Kurata kwebs1.9
  http://unyora.sakura.ne.jp/cgi-bin/dlrank2_3/dlranklog.cgi?dl=kwebs1.9

Kantan WEB Server Unspecified Directory Traversal Vulnerability

References:

• JVN#79026329 - Kantan WEB Server directory traversal vulnerability (JPCERT/CC)
  
• Kantan WEB Server Homepage (Arihiro Kurata)