Adobe JRun 'logviewer.jsp' Directory Traversal Vulnerability

Bugtraq ID:	36047
Class:	Input Validation Error
CVE:	CVE-2009-1873
Remote:	Yes
Local:	No
Published:	Aug 17 2009 12:00AM
Updated:	Oct 06 2009 03:49PM
Credit:	Digital Security Research Group
Vulnerable:	Adobe JRun 4.0 Updater 7
Not Vulnerable:

Adobe JRun 'logviewer.jsp' Directory Traversal Vulnerability

Adobe JRun is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.

Adobe JRun 4 Updater 7 is vulnerable; prior versions may also be affected.

Adobe JRun 'logviewer.jsp' Directory Traversal Vulnerability

An attacker can exploit this issue via a browser.

The following proof-of-concept URI is available:

http://www.example.com/CuteSoft_Client/CuteEditor/Load.ashx?type=image&file=../../../web.config

Adobe JRun 'logviewer.jsp' Directory Traversal Vulnerability

Solution:
The vendor has released an update. Please see the references for details.


Adobe JRun 4.0 Updater 7

• Adobe jmc-app.ear
  http://download.macromedia.com/pub/coldfusion/updates/jmc-app.ear


• Adobe jmc-app2.zip
  http://download.macromedia.com/pub/coldfusion/updates/jmc-app2.zip

Adobe JRun 'logviewer.jsp' Directory Traversal Vulnerability

References:

• Installation instructions for CVE-2009-1873 and CVE-2009-1874 (Adobe)
  
• JRun Homepage (Adobe)
  
• ReadMe_1873_1874b (Adobe)
  
• [DSECRG-09-052] Adobe JRun 4 Directory Traversal Vulnerabilities ([email protected])
  
• Security Update: Hotfixes available for ColdFusion and JRun (Adobe)