MPNews PRO Directory Traversal Information Disclosure Vulnerability

Bugtraq ID:	8744
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 01 2003 12:00AM
Updated:	Oct 01 2003 12:00AM
Credit:	The discovery of this vulnerability has been credited to Gama Sec <[email protected]>.
Vulnerable:	Mutant Penguin MPNews Pro 2.1 .0.18
Not Vulnerable:

MPNews PRO Directory Traversal Information Disclosure Vulnerability

It has been reported that MPNews PRO is prone to an information disclosure vulnerability. The problem is believed to occur due to MPNews PRO failing to sufficiently filter specific dot-dot-slash sequences (../). As a result, an attacker may be capable of viewing the contents of files located outside of the established web root.

MPNews PRO Directory Traversal Information Disclosure Vulnerability

This issue can be exploited by issuing a request for a known system file using an HTTP request formatted as shown below.

http://www.example.org/./.././../mpnews.ini

MPNews PRO Directory Traversal Information Disclosure Vulnerability

Solution:
It has been reported that a fix is pending. This information however, has not been confirmed by Symantec.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

MPNews PRO Directory Traversal Information Disclosure Vulnerability

References:

• MPNews PRO Homepage (Mutant Penguin)