Openfire 'log.jsp' Directory Traversal Vulnerability

Bugtraq ID:	32945
Class:	Input Validation Error
CVE:	CVE-2009-0497
Remote:	Yes
Local:	No
Published:	Jan 08 2009 12:00AM
Updated:	Mar 19 2015 09:11AM
Credit:	Federico Muttis of Core Security Technologies
Vulnerable:	Ignite Realtime Openfire 3.6.2 Ignite Realtime Openfire 3.5.2 Ignite Realtime Openfire 3.5.1 Ignite Realtime Openfire 3.5 Ignite Realtime Openfire 3.4.5 Ignite Realtime Openfire 3.4.4 Ignite Realtime Openfire 3.4.3 Ignite Realtime Openfire 3.4.2 Ignite Realtime Openfire 3.4.1 Ignite Realtime Openfire 3.4 Ignite Realtime Openfire 3.3.1 Ignite Realtime Openfire 3.3 Ignite Realtime Openfire 3.6.0a Gentoo Linux
Not Vulnerable:	Ignite Realtime Openfire 3.6.3

Openfire 'log.jsp' Directory Traversal Vulnerability

Openfire is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.

Openfire 3.6.2 is vulnerable; prior versions may also be affected.

Openfire 'log.jsp' Directory Traversal Vulnerability

An attacker can exploit this issue with a browser.

The following example URI is available:

http://www.example.com/log.jsp?log=..\..\..\windows\debug\netsetup

Openfire 'log.jsp' Directory Traversal Vulnerability

Solution:
Vendor updates are available. Contact the vendor for details.

Openfire 'log.jsp' Directory Traversal Vulnerability

References:

• Openfire Homepage (Ignite Realtime)
  
• CORE-2008-1128: Openfire multiple vulnerabilities (CORE Security Technologies Advisories )
  
• Openfire multiple vulnerabilities (Core Security Technologies)