Arcserve Unified Data Protection CVE-2015-4068 Multiple Directory Traversal Vulnerabilities

Bugtraq ID:	74845
Class:	Input Validation Error
CVE:	CVE-2015-4068
Remote:	Yes
Local:	No
Published:	May 27 2015 12:00AM
Updated:	May 27 2015 12:00AM
Credit:	rgod
Vulnerable:	Arcserve Unified Data Protection 0
Not Vulnerable:

Arcserve Unified Data Protection CVE-2015-4068 Multiple Directory Traversal Vulnerabilities

Arcserve Unified Data Protection is prone to multiple remote directory traversal vulnerabilities.

A remote attacker can use specially crafted requests with directory-traversal sequences ('../') to disclose sensitive information and cause denial-of-service condition.

Arcserve Unified Data Protection CVE-2015-4068 Multiple Directory Traversal Vulnerabilities

An attacker can exploit this issue using readily available tools.

Arcserve Unified Data Protection CVE-2015-4068 Multiple Directory Traversal Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Arcserve Unified Data Protection CVE-2015-4068 Multiple Directory Traversal Vulnerabilities

References:

• Unified Data Protection Product Page (Arcserve)
  
• Arcserve Unified Data Protection Management Service exportServlet Directory Trav (TippingPoint Zero Day Initiative)
  
• Arcserve Unified Data Protection Management Service reportFileServlet Directory (TippingPoint Zero Day Initiative)