phion airlock Remote Command Execution and Denial Of Service Vulnerability

Bugtraq ID:	35549
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 01 2009 12:00AM
Updated:	Jul 07 2009 09:27PM
Credit:	Michael Kirchner, Wolfgang Neudorfer, Lukas Nothdurfter (Team h4ck!nb3rg)
Vulnerable:	phion airlock 4.1-10.41
Not Vulnerable:

phion airlock Remote Command Execution and Denial Of Service Vulnerability

'phion airlock' is prone to a vulnerability that allows attackers to execute arbitrary commands or cause denial-of-service conditions because the software fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary shell commands on an affected computer with the privileges of the webserver or crash the server, denying further service to legitimate users.

The issue affects phion airlock 4.1-10.41; prior versions may also be vulnerable.

phion airlock Remote Command Execution and Denial Of Service Vulnerability

Attackers can exploit this issue via a browser.

phion airlock Remote Command Execution and Denial Of Service Vulnerability

Solution:
The vendor has released updates. Please see the references for details.

phion airlock Remote Command Execution and Denial Of Service Vulnerability

References:

• Vendor Homepage (phion)
  
• phion airlock Web Application Firewall vulnerability (Team h4ck!nb3rg)