Thunderstone TEXIS 'texis.exe' Information Disclosure Vulnerability

Bugtraq ID:	7105
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 14 2003 12:00AM
Updated:	Aug 27 2009 10:22PM
Credit:	Discovery of this vulnerability has been credited to [email protected].
Vulnerable:	Thunderstone Texis 3.0 Thunderstone Texis 0
Not Vulnerable:	Thunderstone Texis 4.2.1047934696 20030317

Thunderstone TEXIS 'texis.exe' Information Disclosure Vulnerability

Thunderstone TEXIS is prone to an information-disclosure vulnerability.

Under certain circumstances, an attacker may pass command-line switches as URI parameters to the TEXIS executable. This action may cause the vulnerable server to return sensitive information in the form of a webpage to the attacker's browser.

Information obtained may be used in further attacks against the system.

Versions prior to Texis 4.02.1047934696 20030317 are vulnerable.

Thunderstone TEXIS 'texis.exe' Information Disclosure Vulnerability

Solution:
Updates are available. Please contact the vendor for details.

Thunderstone TEXIS 'texis.exe' Information Disclosure Vulnerability

References:

• Texis Product Homepage (Thunderstone)
  
• @(#)Mordred Labs advisory - Texis sensitive information leak ([email protected])
  
• Re: @(#)Mordred Labs advisory - Texis sensitive information leak ("Kurt Seifried" )
  
• Re: @(#)Mordred Labs advisory - Texis sensitive information leak ("Kurt Seifried" )
  
• Re: @(#)Mordred Labs advisory - Texis sensitive information leak (Thunderstone )