Allaire JRun Web Server Directory Traversal Vulnerability

Bugtraq ID:	3666
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 06 2001 12:00AM
Updated:	Dec 06 2001 12:00AM
Credit:	This vulnerability was announced in an Allaire Security Advisory on December 6, 2001.
Vulnerable:	Macromedia JRun 3.1 - IBM AIX 4.3 - IBM AIX 4.2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Redhat Linux 6.1 sparc - Redhat Linux 6.1 i386 - Redhat Linux 6.1 alpha - Redhat Linux 6.0 sparc - Redhat Linux 6.0 alpha - Redhat Linux 6.0 - SGI IRIX 6.5 - Sun Solaris 8_sparc - Sun Solaris 7.0 Macromedia JRun 3.0 - IBM AIX 4.3 - IBM AIX 4.2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Redhat Linux 6.1 sparc - Redhat Linux 6.1 i386 - Redhat Linux 6.1 alpha - Redhat Linux 6.0 sparc - Redhat Linux 6.0 - SGI IRIX 6.5 - Sun Solaris 7.0 - Sun Solaris 2.6 Macromedia JRun 2.3.3 - IBM AIX 4.3 - IBM AIX 4.2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Redhat Linux 6.1 sparc - Redhat Linux 6.1 i386 - Redhat Linux 6.1 alpha - Redhat Linux 6.0 sparc - Redhat Linux 6.0 alpha - Redhat Linux 6.0 - SGI IRIX 6.5 - Sun Solaris 7.0 - Sun Solaris 2.6
Not Vulnerable:

Allaire JRun Web Server Directory Traversal Vulnerability

JRun is a web server implementation distributed by Allaire.

JRun does not handle path identifiers correctly, such as the dot-dot-slash (../) identifier, making it possible for a user to escape the web root directory. This vulnerability could be exploited to gather intelligence on a vulnerable host, and could potentially lead to a remote user gaining such information as usernames, system configuration information, or user-owned files that do not have restrictive permissions set.

Allaire JRun Web Server Directory Traversal Vulnerability

No exploit is required for this vulnerability.

Allaire JRun Web Server Directory Traversal Vulnerability

Solution:
Vendor fixes available:


Macromedia JRun 2.3.3

• Allaire Unix JRun 2.3.3 jp23159u_22129.tar.gz
  http://download.allaire.com/publicdl/en/jrun/23/jp23159u_22129.tar.gz


• Allaire Windows JRun 2.3.3 jp23159w_22129.exe
  http://download.allaire.com/publicdl/en/jrun/23/jp23159w_22129.exe

Macromedia JRun 3.0

• Allaire Unix JRun 3.0 jr30sp2u_25232.sh
  http://download.allaire.com/publicdl/en/jrun/30/jr30sp2u_25232.sh


• Allaire Windows JRun 3.0 jr30sp2_25232.exe
  http://download.allaire.com/publicdl/en/jrun/30/jr30sp2_25232.exe

Macromedia JRun 3.1

• Allaire Unix JRun 3.1 jrun-31-unix-upgrade-us_26414.sh
  http://download.allaire.com/publicdl/en/jrun/31/jrun-31-unix-upgrade-u s_26414.sh


• Allaire Windows JRun 3.1 jrun-31-win-upgrade-us_26414.exe
  http://download.allaire.com/publicdl/en/jrun/31/jrun-31-win-upgrade-us _26414.exe

Allaire JRun Web Server Directory Traversal Vulnerability

References:

• Macromedia Product Security Bulletin (MPSB01-17) (Macromedia)