Alt-N WebAdmin Remote File Viewing Vulnerability

Bugtraq ID:	7438
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 25 2003 12:00AM
Updated:	Feb 01 2008 08:57PM
Credit:	Discovery is credited to =?iso-8859-1?Q?David_A._P=E9rez?= <[email protected]> and Petur Ingi Egilsson.
Vulnerable:	Altn WebAdmin 2.0.2 Altn WebAdmin 2.0.1 Altn WebAdmin 2.0 .0
Not Vulnerable:	Altn WebAdmin 2.0.3

Alt-N WebAdmin Remote File Viewing Vulnerability

Alt-N WebAdmin allows a remote user to access files that they should not be able to access. The remote user can submit an HTTP request that will return the contents of any webserver-readable file on the system.

NOTE: The user must have administrative privileges in WebAdmin to access these files.

Alt-N WebAdmin Remote File Viewing Vulnerability

Attackers may exploit this issue through a browser.

The following proof of concept was provided:

http://server/WebAdmin.dll?Session=X&Program=MDaemon&Directory:Name=C:\WINNT&File:Name=WIN.INI&View=ViewFile

Alt-N WebAdmin Remote File Viewing Vulnerability

Solution:
The vendor has released a new version of WebAdmin.


Altn WebAdmin 2.0 .0

• Alt-N WebAdmin 2.0.3
  http://www.altn.com/download/default.asp#WebAdmin

Altn WebAdmin 2.0.1

• Alt-N WebAdmin 2.0.3
  http://www.altn.com/download/default.asp#WebAdmin

Altn WebAdmin 2.0.2

• Alt-N WebAdmin 2.0.3
  http://www.altn.com/download/default.asp#WebAdmin

Alt-N WebAdmin Remote File Viewing Vulnerability

References:

• Alt-N Homepage (Alt-N)
  
• Howto crack the MDaemon password file manualy (Petur Ingi Egilsson)
  
• Path disclosure and file access on WebAdmin (=?iso-8859-1?Q?David_A._P=E9rez?= )