Vicomsoft RapidCache Server Directory Traversal Vulnerability

Bugtraq ID:	9428
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 15 2004 12:00AM
Updated:	Jan 15 2004 12:00AM
Credit:	The disclosure of this issue has been credited to Peter Winter-Smith <[email protected]>.
Vulnerable:	Vicomsoft RapidCache 2.2.6 Vicomsoft RapidCache 2.0
Not Vulnerable:

Vicomsoft RapidCache Server Directory Traversal Vulnerability

It has been reported that RapidCache may be prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory using '../' character sequences.

RapidCache versions 2.2.6 and prior have been reported to be prone to this issue.

Vicomsoft RapidCache Server Directory Traversal Vulnerability

No exploit is required.

The following proof of concept has been provided:

http://www.example.com:8080/../../../../../../../../windows/win.ini

Vicomsoft RapidCache Server Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Vicomsoft RapidCache Server Directory Traversal Vulnerability

References:

• RapidCache Product Page (Vicomsoft)
  
• RapidCache Multiple Vulnerabilities ("Peter Winter-Smith" )