Orb Networks Orb Unspecified Directory Traversal Vulnerability

Bugtraq ID:	32187
Class:	Input Validation Error
CVE:	CVE-2008-5645
Remote:	Yes
Local:	No
Published:	Nov 07 2008 12:00AM
Updated:	May 07 2015 05:21PM
Credit:	Steven James and r@b13$
Vulnerable:	Orb Networks Orb 2.1.1017 Orb Networks Orb 2.1.1013 + NullSoft Winamp Remote BETA 0
Not Vulnerable:	Orb Networks Orb 2.1.1022

Orb Networks Orb Unspecified Directory Traversal Vulnerability

Orb Networks Orb is prone to an unspecified directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary local files within the context of the Orb server. Information harvested may aid in launching further attacks.

This issue has been reported in the following versions:

- Versions prior to Orb 2.01.0022
- Orb 2.01.0013 branded as Nullsoft Winamp Remote Media Beta

Orb Networks Orb Unspecified Directory Traversal Vulnerability

An attacker can exploit this issue using common networking tools.

Orb Networks Orb Unspecified Directory Traversal Vulnerability

Solution:
The vendor has released an updated version; please see the references for more information.


Orb Networks Orb 2.1.1013

• Orb Networks setup_2.01.0022.exe
  http://www.orb.com/download/us/setup_2.01.0022.exe

Orb Networks Orb 2.1.1017

• Orb Networks setup_2.01.0022.exe
  http://www.orb.com/download/us/setup_2.01.0022.exe

Orb Networks Orb Unspecified Directory Traversal Vulnerability

References:

• Orb Homepage (Orb Networks)
  
• Winamp Home Page (NullSoft)