CGI RESCUE MiniBBS2000 Unspecified Directory Traversal Vulnerability

Bugtraq ID:	32485
Class:	Input Validation Error
CVE:	CVE-2008-5723
Remote:	Yes
Local:	No
Published:	Nov 13 2008 12:00AM
Updated:	Dec 31 2008 07:42PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	CGI RESCUE MiniBBS2000i 1.02 CGI RESCUE MiniBBS2000 1.02
Not Vulnerable:	CGI RESCUE MiniBBS2000i 1.03 CGI RESCUE MiniBBS2000 1.03

CGI RESCUE MiniBBS2000 Unspecified Directory Traversal Vulnerability

CGI RESCUE MiniBBS2000 is prone to an unspecified directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.

Versions prior to MiniBBS2000 1.0.3 are vulnerable.

CGI RESCUE MiniBBS2000 Unspecified Directory Traversal Vulnerability

An attacker can exploit this issue via a browser.

CGI RESCUE MiniBBS2000 Unspecified Directory Traversal Vulnerability

Solution:
The vendor has released an updated version; please see the references for more information.


CGI RESCUE MiniBBS2000 1.02

• CGI RESCUE minibbs.cgi
  http://www.rescue.ne.jp/cgi/minibbs2000/minibbs.cgi

CGI RESCUE MiniBBS2000i 1.02

• CGI RESCUE minibbs.cgi
  http://www.rescue.ne.jp/cgi/minibbs2000i/minibbs.cgi

CGI RESCUE MiniBBS2000 Unspecified Directory Traversal Vulnerability

References:

• ???: ??BBS2000???BBS ..: (CGI RESCUE)
  
• JVN#86833991 CGI RESCUE KanniBBS2000 directory traversal vulnerability (JVN)