Flussonic Media Server Multiple Information Disclosure Vulnerabilities

Bugtraq ID:	68248
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 29 2014 12:00AM
Updated:	Jun 29 2014 12:00AM
Credit:	Bilgi Güvenligi Akademisi
Vulnerable:	Flussonic Media Server Flussonic Media Server 4.3.3 Flussonic Media Server Flussonic Media Server 4.1.25
Not Vulnerable:	Flussonic Media Server Flussonic Media Server 4.3.4

Flussonic Media Server Multiple Information Disclosure Vulnerabilities

Flussonic Media Server is prone to multiple information disclosure vulnerabilities.

Remote attackers can use a specially crafted request with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application or obtain potentially sensitive information from local files that could aid in further attacks.

Flussonic Media Server 4.1.25 through 4.3.3 are vulnerable.

Flussonic Media Server Multiple Information Disclosure Vulnerabilities

An attacker can exploit these issues through a browser.

Flussonic Media Server Multiple Information Disclosure Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Flussonic Media Server Multiple Information Disclosure Vulnerabilities

References:

• Flussonic Media Server 4.3.3 Multiple Vulnerabilities (Bilgi Güvenligi Akademisi)
  
• Flussonic Media Server Homepage (flussonic)