Honeywell Experion PKS 'confd.exe' Module Directory Traversal Vulnerability

Bugtraq ID:	71752
Class:	Input Validation Error
CVE:	CVE-2014-5436
Remote:	Yes
Local:	No
Published:	Dec 18 2014 12:00AM
Updated:	Dec 18 2014 12:00AM
Credit:	Alexander Tlyapov, Gleb Gritsai, Kirill Nesterov, Artem Chaykin and Ilya Karpov of the Positive Technologies Research Team and Security Lab
Vulnerable:	Honeywell Experion PKS R430.1 Honeywell Experion PKS R430 Honeywell Experion PKS R410.5 Honeywell Experion PKS R410 Honeywell Experion PKS R400.5 Honeywell Experion PKS R400 Honeywell Experion PKS R311.2
Not Vulnerable:	Honeywell Experion PKS R430.2 Honeywell Experion PKS R410.6 Honeywell Experion PKS R400.6

Honeywell Experion PKS 'confd.exe' Module Directory Traversal Vulnerability

Honeywell Experion PKS is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Remote attackers can use a specially crafted request with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application. Information obtained could aid in further attacks.

The following versions are affected:

Honeywell Experion R40x versions prior to Experion PKS R400.6
Honeywell Experion R41x versions prior to Experion PKS R410.6
Honeywell Experion R43x versions prior to Experion PKS R430.2

Honeywell Experion PKS 'confd.exe' Module Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.