Wibu-Systems CodeMeter License Server Directory Traversal Vulnerability

Bugtraq ID:	49437
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 02 2011 12:00AM
Updated:	Dec 22 2011 06:30PM
Credit:	Luigi Auriemma
Vulnerable:	Wibu-Systems CodeMeter 4.30c
Not Vulnerable:	Wibu-Systems CodeMeter 4.30d

Wibu-Systems CodeMeter License Server Directory Traversal Vulnerability

Wibu-Systems CodeMeter is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to download arbitrary files with certain extensions from outside the server root directory. This may aid in further attacks.

CodeMeter 4.30c is affected; other versions may also be vulnerable.

Wibu-Systems CodeMeter License Server Directory Traversal Vulnerability

Attackers can use a browser to exploit this issue.

Exploit code is available. Please see the references for information.

Wibu-Systems CodeMeter License Server Directory Traversal Vulnerability

Solution:
Updates are available; please see the references for more information.

Wibu-Systems CodeMeter License Server Directory Traversal Vulnerability

References:

• CodeMeter Homepage (Wibu-Systems)
  
• CodeMeter limited directory traversal (Luigi Auriemma)