mcNews File Disclosure Vulnerability

Bugtraq ID:	4770
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 17 2002 12:00AM
Updated:	May 17 2002 12:00AM
Credit:	Discovery of this issue is credited to frog frog <[email protected]>.
Vulnerable:	McNews McNews 1.2 McNews McNews 1.1 a McNews McNews 1.1 McNews McNews 1.0
Not Vulnerable:

mcNews File Disclosure Vulnerability

mcNews is a set of scripts for allowing users to post news stories on a webpage. It will run on most Linux and Unix variants as well as Microsoft Windows operating systems.

mcNews does not sufficiently filter dot-dot-slash (../) sequences from URL parameters. As a result, a remote attacker can disclose the contents of arbitrary web-readable files that exist on a host running the vulnerable software.

mcNews File Disclosure Vulnerability

This vulnerability may be exploited with a web browser. The following example may be used to reproduce this condition:

http://target/admin/header.php?voir=hop&skinfile=../../file

mcNews File Disclosure Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

mcNews File Disclosure Vulnerability

References:

• mcNews Homepage (mcNews)
  
• Security holes : mcNews (frog frog )