Apple iPhone Configuration Web Utility for Windows Directory Traversal Vulnerability

Bugtraq ID:	32412
Class:	Input Validation Error
CVE:	CVE-2008-5315
Remote:	Yes
Local:	No
Published:	Nov 21 2008 12:00AM
Updated:	Dec 11 2008 05:01AM
Credit:	Corey LeBleu and r@b13$
Vulnerable:	Apple iPhone Configuration Web Utility for Windows 1.0
Not Vulnerable:	Apple iPhone Configuration Utility for Windows 1.1

Apple iPhone Configuration Web Utility for Windows Directory Traversal Vulnerability

Apple iPhone Configuration Web Utility for Windows is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary local files within the context of the webserver. Information harvested may aid in launching further attacks.

iPhone Configuration Web Utility 1.0 for Windows is vulnerable; other versions or platforms may also be affected.

Apple iPhone Configuration Web Utility for Windows Directory Traversal Vulnerability

An attacker can exploit this issue using a web browser.

Apple iPhone Configuration Web Utility for Windows Directory Traversal Vulnerability

Solution:
The vendor has released Configuration Web Utility 1.1 to address this issue. Please see the references for more information.


Apple iPhone Configuration Web Utility for Windows 1.0

• Apple iPhoneConfigUtilitySetup.exe
  http://support.apple.com/downloads/DL740/iPhoneConfigUtilitySetup.exe

Apple iPhone Configuration Web Utility for Windows Directory Traversal Vulnerability

References:

• iPhone Configuration Web Utility for Windows Homepage (Apple)
  
• DDIVRT-2008-15 iPhone Configuration Web Utility 1.0 for Windows Directory Traver ([email protected])
  
• RE: DDIVRT-DDIVRT-2008-15 iPhone Configuration Web Utility 1.0 for Windows Dir ([email protected])