RADactive I-Load Multiple Security Vulnerabilities

Bugtraq ID:	42337
Class:	Input Validation Error
CVE:	CVE-2009-3447 CVE-2009-3450 CVE-2009-3451 CVE-2009-3452
Remote:	Yes
Local:	No
Published:	Sep 18 2009 12:00AM
Updated:	Sep 18 2009 12:00AM
Credit:	S. Streichsbier, SEC Consult
Vulnerable:
Not Vulnerable:

RADactive I-Load Multiple Security Vulnerabilities

RADactive I-Load is prone to multiple security vulnerabilities. These vulnerabilities include multiple cross-site scripting vulnerabilities, multiple information-disclosure vulnerabilities, a path-disclosure vulnerability, and an arbitrary file-upload vulnerability.

An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, disclose or modify sensitive information, upload arbitrary code and run it in the context of the webserver process, or perform unauthorized actions. Other attacks are also possible.

Versions prior to I-Load 2008.2.5.0 are vulnerable.

RADactive I-Load Multiple Security Vulnerabilities

Attackers can exploit these issues via a browser.

RADactive I-Load Multiple Security Vulnerabilities

Solution:
An update is available. Please see the references for more details.

RADactive I-Load Multiple Security Vulnerabilities

References:

• I-Load Homepage (RADactive)
  
• Multiple Vulnerabilities in RADactive I-Load (SEC Consult)
  
• RADactive Homepage (RADactive)
  
• Security update available for RADactive I-Load 2008.R2 (RADactive)