Baltimore Technologies WEBsweeper Restricted Directory Disclosure Vulnerability

Bugtraq ID:	3296
Class:	Input Validation Error
CVE:	CVE-2001-1152
Remote:	Yes
Local:	No
Published:	Sep 05 2001 12:00AM
Updated:	Jul 11 2009 07:56AM
Credit:	Discovered and posted to Bugtraq by edvice Security Services <[email protected]> on Sep 5, 2001.
Vulnerable:	Baltimore Technologies WEBsweeper 4.0 2 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5
Not Vulnerable:

Baltimore Technologies WEBsweeper Restricted Directory Disclosure Vulnerability

WEBsweeper is an application which implements content security of suspicious filetypes, hidden mailtos, web content, HTTP and FTP transfers, scripts, etc.

Due to a flaw in WEBsweeper, a remote user could gain access to known restricted web directories. Requesting for a known directory along with specially chosen characters, could reveal the contents of the unauthorized directory.

Baltimore Technologies WEBsweeper Restricted Directory Disclosure Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Baltimore Technologies WEBsweeper Restricted Directory Disclosure Vulnerability

References:

• MIMEsweeper / Support / Technotes / WEBsweeper and URL blacklists (Baltimore Technologies)
  
• Various problems in Baltimore WebSweeper URL filtering (edvice Security Services )
  
• WEBsweeper Product Page (Baltimore Technologies)