Sockso Directory Traversal Vulnerability

Bugtraq ID:	52509
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 15 2012 12:00AM
Updated:	Mar 15 2012 12:00AM
Credit:	Luigi Auriemma
Vulnerable:	Sockso Sockso 1.5
Not Vulnerable:	Sockso Sockso 1.5.1

Sockso Directory Traversal Vulnerability

Sockso is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application.

Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.

Sockso 1.5 is vulnerable; other versions may also be affected.

Sockso Directory Traversal Vulnerability

An attacker can exploit the issue with a browser.

The following example URI is available:

http://www.example.com:4444/file/../../../../../windows/system.ini

Sockso Directory Traversal Vulnerability

Solution:
Reportedly, the vendor has fixed the issue. However, Symantec has not confirmed it. Please contact the vendor for more information.

Sockso Directory Traversal Vulnerability

References:

• Sockso Directory Traversal Vulnerability (Luigi Auriemma)
  
• Sockso Homepage (Sockso)